StrifeWater
StrifeWater is a remote-access tool that has been used by Moses Staff in the initial stages of their attacks since at least November 2021.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1005 | 从本地系统获取数据 |
StrifeWater can collect data from a compromised host.[1] |
|
| Enterprise | T1036 | .005 | 伪装: Match Legitimate Name or Location |
StrifeWater has been named |
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography |
StrifeWater can encrypt C2 traffic using XOR with a hard coded key.[1] |
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell |
StrifeWater can execute shell commands using |
| Enterprise | T1113 | 屏幕捕获 |
StrifeWater has the ability to take screen captures.[1] |
|
| Enterprise | T1083 | 文件和目录发现 |
StrifeWater can enumerate files on a compromised host.[1] |
|
| Enterprise | T1106 | 本机API |
StrifeWater can use a variety of APIs for execution.[1] |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
StrifeWater can self delete to cover its tracks.[1] |
| Enterprise | T1082 | 系统信息发现 |
StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.[1] |
|
| Enterprise | T1033 | 系统所有者/用户发现 |
StrifeWater can collect the user name from the victim's machine.[1] |
|
| Enterprise | T1124 | 系统时间发现 |
StrifeWater can collect the time zone from the victim's machine.[1] |
|
| Enterprise | T1497 | .003 | 虚拟化/沙盒规避: Time Based Evasion |
StrifeWater can modify its sleep time responses from the default of 20-22 seconds.[1] |
| Enterprise | T1105 | 输入工具传输 |
StrifeWater can download updates and auxiliary modules.[1] |
|
| Enterprise | T1041 | 通过C2信道渗出 |
StrifeWater can send data and files from a compromised host to its C2 server.[1] |
|
| Enterprise | T1053 | 预定任务/作业 |
StrifeWater has create a scheduled task named |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1009 | Moses Staff |