MechaFlounder

Malware & Tools · MechaFlounder

· MalwareS0459 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

MechaFlounder is a python-based remote access tool (RAT) that has been used by APT39. The payload uses a combination of actor developed code and code snippets freely available online in development communities.(Citation: Unit 42 MechaFlounder March 2019)

Tactic Coverage

command and control (3)execution (2)discovery (1)stealth (1)exfiltration (1)

Used By (1 groups)

G0087APT39ITG07, Chafer

Techniques (8)

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1059.003Windows Command Shell

execution

T1059.006Python

execution

T1071.001Web Protocols

command and control

T1105Ingress Tool Transfer

References

https://attack.mitre.org/software/S0459 https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/