HAYMAKER (d71604d2-a17e-4b4e-82be-19cb54f93161)

HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	HAYMAKER (d71604d2-a17e-4b4e-82be-19cb54f93161)	Tool	1
ChChes (6eee9bf9-ffce-4c88-a5ad-9d80f6fc727c)	Malpedia	HAYMAKER (d71604d2-a17e-4b4e-82be-19cb54f93161)	Tool	1
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Standard Encoding - T1132.001 (04fd5427-79c7-44ea-ae13-11b24778ff1c)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	ChChes (6eee9bf9-ffce-4c88-a5ad-9d80f6fc727c)	Malpedia	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Code Signing - T1553.002 (32901740-b42c-4fdd-bc02-345b5dc57082)	Attack Pattern	2
ChChes - S0144 (dc5d1a33-62aa-4a0c-aa8c-589b87beb11e)	Malware	Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	2
Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118)	Attack Pattern	Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	3
Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8)	Attack Pattern	Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0)	Attack Pattern	3
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529)	Attack Pattern	3
Standard Encoding - T1132.001 (04fd5427-79c7-44ea-ae13-11b24778ff1c)	Attack Pattern	Data Encoding - T1132 (cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f)	Attack Pattern	3
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2)	Attack Pattern	3
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	3
Subvert Trust Controls - T1553 (b83e166d-13d7-4b52-8677-dff90c548fd7)	Attack Pattern	Code Signing - T1553.002 (32901740-b42c-4fdd-bc02-345b5dc57082)	Attack Pattern	3
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	3