Pcexter - S1102 (e4feffc2-53d1-45c9-904e-adb9faca0d15)

Pcexter is an uploader that has been used by ToddyCat since at least 2023 to exfiltrate stolen files.(Citation: Kaspersky ToddyCat Check Logs October 2023)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Pcexter - S1102 (e4feffc2-53d1-45c9-904e-adb9faca0d15)	Malware	Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5)	Attack Pattern	1
Pcexter - S1102 (e4feffc2-53d1-45c9-904e-adb9faca0d15)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Pcexter - S1102 (e4feffc2-53d1-45c9-904e-adb9faca0d15)	Malware	DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b)	Attack Pattern	1
Pcexter - S1102 (e4feffc2-53d1-45c9-904e-adb9faca0d15)	Malware	Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b)	Attack Pattern	1
DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b)	Attack Pattern	Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	2
Exfiltration Over Web Service - T1567 (40597f16-0963-4249-bf4c-ac93b7fb9807)	Attack Pattern	Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b)	Attack Pattern	2