1. Home
  2. Software
  3. MURKYTOP

MURKYTOP

MURKYTOP is a reconnaissance tool used by Leviathan. [1]

ID: S0233
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 18 April 2018
Last Modified: 30 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

MURKYTOP uses the command-line interface.[1]
Enterprise T1069 权限组发现

MURKYTOP has the capability to retrieve information about groups.[1]
Enterprise T1070 .004 移除指标: File Deletion

MURKYTOP has the capability to delete local files.[1]
Enterprise T1082 系统信息发现

MURKYTOP has the capability to retrieve information about the OS.[1]
Enterprise T1135 网络共享发现

MURKYTOP has the capability to retrieve information about shares on remote hosts.[1]
Enterprise T1046 网络服务发现

MURKYTOP has the capability to scan for open ports on hosts in a connected network.[1]
Enterprise T1087 .001 账号发现: Local Account

MURKYTOP has the capability to retrieve information about users on remote hosts.[1]
Enterprise T1018 远程系统发现

MURKYTOP has the capability to identify remote hosts on connected networks.[1]
Enterprise T1053 .002 预定任务/作业: At

MURKYTOP has the capability to schedule remote AT jobs.[1]

Groups That Use This Software

ID Name References
G0065 Leviathan

[1][2]

References

  1. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  1. CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.