CARROTBALL - S0465 (5fc81b43-62b5-41b1-9113-c79ae5f030c4)

CARROTBALL is an FTP downloader utility that has been in use since at least 2019. CARROTBALL has been used as a downloader to install SYSCON.(Citation: Unit 42 CARROTBAT January 2020)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
File Transfer Protocols - T1071.002 (9a60a291-8960-4387-8a4a-2ab5c18bb50b)	Attack Pattern	CARROTBALL - S0465 (5fc81b43-62b5-41b1-9113-c79ae5f030c4)	mitre-tool	1
CARROTBALL - S0465 (5fc81b43-62b5-41b1-9113-c79ae5f030c4)	mitre-tool	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	CARROTBALL - S0465 (5fc81b43-62b5-41b1-9113-c79ae5f030c4)	mitre-tool	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	CARROTBALL - S0465 (5fc81b43-62b5-41b1-9113-c79ae5f030c4)	mitre-tool	1
File Transfer Protocols - T1071.002 (9a60a291-8960-4387-8a4a-2ab5c18bb50b)	Attack Pattern	Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	2
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	2