| DragonOK (a9b44750-992c-4743-8922-129880d277ea) |
Threat Actor |
DragonOK - G0017 (f3bdec95-3d62-42d9-a840-29630f6cdc1a) |
Intrusion Set |
1 |
| DragonOK (a9b44750-992c-4743-8922-129880d277ea) |
Threat Actor |
Moafee - G0002 (2e5d3a83-fe00-41a5-9b60-237efc84832f) |
Intrusion Set |
1 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
DragonOK - G0017 (f3bdec95-3d62-42d9-a840-29630f6cdc1a) |
Intrusion Set |
2 |
| PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
DragonOK - G0017 (f3bdec95-3d62-42d9-a840-29630f6cdc1a) |
Intrusion Set |
2 |
| Binary Padding - T1027.001 (5bfccc3f-2326-4112-86cc-c1ece9d8a2b5) |
Attack Pattern |
Moafee - G0002 (2e5d3a83-fe00-41a5-9b60-237efc84832f) |
Intrusion Set |
2 |
| PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
Moafee - G0002 (2e5d3a83-fe00-41a5-9b60-237efc84832f) |
Intrusion Set |
2 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475) |
Attack Pattern |
3 |
| DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) |
Attack Pattern |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Non-Application Layer Protocol - T1095 (c21d5a77-d422-4a69-acd7-2c53c1faa34b) |
Attack Pattern |
3 |
| PlugX (f4b159ea-97e5-483b-854b-c48a78d562aa) |
Tool |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| DNS - T1071.004 (1996eef1-ced3-4d7f-bf94-33298cabbf72) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) |
Attack Pattern |
3 |
| Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Query Registry - T1012 (c32f7008-9fea-41f7-8366-5eb9b74bd896) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) |
Attack Pattern |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) |
Attack Pattern |
3 |
| Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Dead Drop Resolver - T1102.001 (f7827069-0bf2-4764-af4f-23fae0d181b7) |
Attack Pattern |
3 |
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
MSBuild - T1127.001 (c92e3d68-2349-49e4-a341-7edca2deff96) |
Attack Pattern |
3 |
| Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
DLL Search Order Hijacking - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) |
Attack Pattern |
3 |
| Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
PlugX (663f8ef9-4c50-499a-b765-f377d23c1070) |
RAT |
3 |
| Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX (036bd099-fe80-46c2-9c4c-e5c6df8dcdee) |
Malpedia |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) |
Attack Pattern |
3 |
| System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6) |
Attack Pattern |
PlugX - S0013 (64fa0de0-6240-41f4-8638-f4ca7ed528fd) |
Malware |
3 |
| Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Poison Ivy (2abe89de-46dd-4dae-ae22-b49a593aff54) |
Tool |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Poison Ivy (7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7) |
Malpedia |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
Rootkit - T1014 (0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b) |
Attack Pattern |
3 |
| PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) |
Attack Pattern |
3 |
| Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| PoisonIvy (4e104fef-8a2c-4679-b497-6e86d7d47db0) |
RAT |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
Active Setup - T1547.014 (22522668-ddf6-470b-a027-9d6866679f67) |
Attack Pattern |
3 |
| Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| poisonivy (e336aeba-b61a-44e0-a0df-cd52a5839db5) |
Tool |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Application Window Discovery - T1010 (4ae4f953-fe58-4cc8-a327-33257e30a830) |
Attack Pattern |
PoisonIvy - S0012 (b42378e0-f147-496f-992a-26a49705395b) |
Malware |
3 |
| Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) |
Attack Pattern |
Binary Padding - T1027.001 (5bfccc3f-2326-4112-86cc-c1ece9d8a2b5) |
Attack Pattern |
3 |
| DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b) |
Attack Pattern |
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) |
Attack Pattern |
4 |
| PlugX (f4b159ea-97e5-483b-854b-c48a78d562aa) |
Tool |
PlugX (036bd099-fe80-46c2-9c4c-e5c6df8dcdee) |
Malpedia |
4 |
| PlugX (f4b159ea-97e5-483b-854b-c48a78d562aa) |
Tool |
PlugX (663f8ef9-4c50-499a-b765-f377d23c1070) |
RAT |
4 |
| Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) |
Attack Pattern |
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) |
Attack Pattern |
4 |
| Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) |
Attack Pattern |
DNS - T1071.004 (1996eef1-ced3-4d7f-bf94-33298cabbf72) |
Attack Pattern |
4 |
| Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2) |
Attack Pattern |
Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) |
Attack Pattern |
4 |
| Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) |
Attack Pattern |
Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) |
Attack Pattern |
4 |
| Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) |
Attack Pattern |
Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) |
Attack Pattern |
4 |
| Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) |
Attack Pattern |
Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) |
Attack Pattern |
4 |
| Web Service - T1102 (830c9528-df21-472c-8c14-a036bf17d665) |
Attack Pattern |
Dead Drop Resolver - T1102.001 (f7827069-0bf2-4764-af4f-23fae0d181b7) |
Attack Pattern |
4 |
| Trusted Developer Utilities Proxy Execution - T1127 (ff25900d-76d5-449b-a351-8824e62fc81b) |
Attack Pattern |
MSBuild - T1127.001 (c92e3d68-2349-49e4-a341-7edca2deff96) |
Attack Pattern |
4 |
| Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) |
Attack Pattern |
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) |
Attack Pattern |
4 |
| Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) |
Attack Pattern |
DLL Search Order Hijacking - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) |
Attack Pattern |
4 |
| Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118) |
Attack Pattern |
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41) |
Attack Pattern |
4 |
| PlugX (036bd099-fe80-46c2-9c4c-e5c6df8dcdee) |
Malpedia |
PlugX (663f8ef9-4c50-499a-b765-f377d23c1070) |
RAT |
4 |
| Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32) |
Attack Pattern |
Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5) |
Attack Pattern |
4 |
| Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) |
Attack Pattern |
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) |
Attack Pattern |
4 |
| Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d) |
Attack Pattern |
System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6) |
Attack Pattern |
4 |
| Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c) |
Attack Pattern |
Data Staged - T1074 (7dd95ff6-712e-4056-9626-312ea4ab4c5e) |
Attack Pattern |
4 |
| Poison Ivy (2abe89de-46dd-4dae-ae22-b49a593aff54) |
Tool |
Poison Ivy (7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7) |
Malpedia |
4 |
| Poison Ivy (2abe89de-46dd-4dae-ae22-b49a593aff54) |
Tool |
PoisonIvy (4e104fef-8a2c-4679-b497-6e86d7d47db0) |
RAT |
4 |
| APT14 (c82c904f-b3b4-40a2-bf0d-008912953104) |
Threat Actor |
Poison Ivy (2abe89de-46dd-4dae-ae22-b49a593aff54) |
Tool |
4 |
| Poison Ivy (2abe89de-46dd-4dae-ae22-b49a593aff54) |
Tool |
poisonivy (e336aeba-b61a-44e0-a0df-cd52a5839db5) |
Tool |
4 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) |
Attack Pattern |
4 |
| PoisonIvy (4e104fef-8a2c-4679-b497-6e86d7d47db0) |
RAT |
Poison Ivy (7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7) |
Malpedia |
4 |
| APT14 (c82c904f-b3b4-40a2-bf0d-008912953104) |
Threat Actor |
PoisonIvy (4e104fef-8a2c-4679-b497-6e86d7d47db0) |
RAT |
4 |
| poisonivy (e336aeba-b61a-44e0-a0df-cd52a5839db5) |
Tool |
PoisonIvy (4e104fef-8a2c-4679-b497-6e86d7d47db0) |
RAT |
4 |
| Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) |
Attack Pattern |
Active Setup - T1547.014 (22522668-ddf6-470b-a027-9d6866679f67) |
Attack Pattern |
4 |
| poisonivy (e336aeba-b61a-44e0-a0df-cd52a5839db5) |
Tool |
Poison Ivy (7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7) |
Malpedia |
4 |
| APT14 (c82c904f-b3b4-40a2-bf0d-008912953104) |
Threat Actor |
Torn RAT (32a67552-3b31-47bb-8098-078099bbc813) |
Tool |
5 |
| APT14 (c82c904f-b3b4-40a2-bf0d-008912953104) |
Threat Actor |
Gh0st Rat (cb8c8253-4024-4cc9-8989-b4a5f95f6c2f) |
Tool |
5 |
| APT14 (c82c904f-b3b4-40a2-bf0d-008912953104) |
Threat Actor |
Gh0st RAT (255a59a7-db2d-44fc-9ca9-5859b65817c3) |
RAT |
5 |
| Gh0st Rat (cb8c8253-4024-4cc9-8989-b4a5f95f6c2f) |
Tool |
APT43 (aac49b4e-74e9-49fa-84f9-e340cf8bafbc) |
Threat Actor |
6 |
| Gh0st RAT (255a59a7-db2d-44fc-9ca9-5859b65817c3) |
RAT |
Ghost RAT (225fa6cf-dc9c-4b86-873b-cdf1d9dd3738) |
Malpedia |
6 |