HyperBro, Software S0398 | MITRE ATT&CK®

Domain	ID		Name	Use
Enterprise	T1574	.002	劫持执行流: DLL Side-Loading	HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.^[1]^[4]
Enterprise	T1140		反混淆/解码文件或信息	HyperBro can unpack and decrypt its payload prior to execution.^[5]^[4]
Enterprise	T1113		屏幕捕获	HyperBro has the ability to take screenshots.^[1]
Enterprise	T1071	.001	应用层协议: Web Protocols	HyperBro has used HTTPS for C2 communications.^[1]
Enterprise	T1106		本机API	HyperBro has the ability to run an application (`CreateProcessW`) or script/file (`ShellExecuteW`) via API.^[1]
Enterprise	T1027	.002	混淆文件或信息: Software Packing	HyperBro has the ability to pack its payload.^[4]
		.013	混淆文件或信息: Encrypted/Encoded File	HyperBro can be delivered encrypted to a compromised host.^[5]
Enterprise	T1070	.004	移除指标: File Deletion	HyperBro has the ability to delete a specified file.^[1]
Enterprise	T1569	.002	系统服务: Service Execution	HyperBro has the ability to start and stop a specified service.^[1]
Enterprise	T1007		系统服务发现	HyperBro can list all services and their configurations.^[1]
Enterprise	T1105		输入工具传输	HyperBro has the ability to download additional files.^[1]
Enterprise	T1055		进程注入	HyperBro can run shellcode it injects into a newly created process.^[1]

HyperBro