GrimAgent

Malware & Tools · GrimAgent

· MalwareS0632 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

GrimAgent is a backdoor that has been used before the deployment of Ryuk ransomware since at least 2020; it is likely used by FIN6 and Wizard Spider.(Citation: Group IB GrimAgent July 2021)

Tactic Coverage

discovery (7)stealth (7)command and control (6)execution (3)persistence (2)privilege escalation (2)collection (1)exfiltration (1)

Used By (2 groups)

G0037FIN6Magecart Group 6, ITG08 G0102Wizard SpiderUNC1878, TEMP.MixMaster

Techniques (25)

T1001.001Junk Data

command and control

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1027.001Binary Padding

stealth

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

References

https://attack.mitre.org/software/S0632 https://www.group-ib.com/blog/grimagent/

T1053.005Scheduled Task

executionpersistence

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1070.009Clear Persistence

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1132.001Standard Encoding

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1480.002Mutual Exclusion

stealth

T1497.003Time Based Checks

stealthdiscovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1573.001Symmetric Cryptography

command and control

T1573.002Asymmetric Cryptography

command and control

T1614System Location Discovery

discovery

T1614.001System Language Discovery

discovery