CozyCar

Malware & Tools · CozyCar

· MalwareS0046 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

CozyCar is malware that was used by APT29 from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality. (Citation: F-Secure The Dukes)

Tactic Coverage

stealth (4)persistence (3)privilege escalation (3)discovery (3)credential access (2)execution (2)command and control (2)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (14)

T1003.001LSASS Memory

credential access

T1003.002Security Account Manager

credential access

T1027.013Encrypted/Encoded File

stealth

T1036.003Rename Legitimate Utilities

stealth

T1053.005Scheduled Task

executionpersistence

T1059.003Windows Command Shell

execution

References

https://attack.mitre.org/software/S0046 https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf