EvilGrab

Malware & Tools · EvilGrab

· MalwareS0152 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns. (Citation: PWC Cloud Hopper Technical Annex April 2017)

Tactic Coverage

collection (4)credential access (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0045menuPassCicada, POTASSIUM

Techniques (5)

T1056.001Keylogging

collectioncredential access

T1113Screen Capture

collection

T1123Audio Capture

collection

T1125Video Capture

collection

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

References

https://attack.mitre.org/software/S0152 https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf