Crimson

Malware & Tools · Crimson

· MalwareS0115 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Crimson is a remote access Trojan that has been used by Transparent Tribe since at least 2016.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)

Tactic Coverage

discovery (12)collection (7)stealth (3)command and control (3)credential access (2)persistence (2)exfiltration (1)execution (1)lateral movement (1)initial access (1)defense impairment (1)privilege escalation (1)

Used By (1 groups)

G0134Transparent TribeCOPPER FIELDSTONE, APT36

Techniques (30)

T1005Data from Local System

collection

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1025Data from Removable Media

collection

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1056.001Keylogging

References

https://attack.mitre.org/software/S0115 https://securelist.com/transparent-tribe-part-1/98127/https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1091Replication Through Removable Media

lateral movementinitial access

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1114.001Local Email Collection

collection

T1120Peripheral Device Discovery

discovery

T1123Audio Capture

collection

T1124System Time Discovery

discovery

T1125Video Capture

collection

T1140Deobfuscate/Decode Files or Information

stealth

T1497.003Time Based Checks

stealthdiscovery

T1518.001Security Software Discovery

discovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1555.003Credentials from Web Browsers

credential access

T1614System Location Discovery

discovery

T1680Local Storage Discovery

discovery