1. Home
  2. Software
  3. SideTwist

SideTwist

SideTwist is a C-based backdoor that has been used by OilRig since at least 2021.[1]

ID: S0610
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 06 May 2021
Last Modified: 13 October 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

SideTwist has the ability to upload files from a compromised host.[1]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

SideTwist can encrypt C2 communications with a randomly generated key.[1]
Enterprise T1140 反混淆/解码文件或信息

SideTwist can decode and decrypt messages received from C2.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

SideTwist can execute shell commands on a compromised host.[1]
Enterprise T1008 回退信道

SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

SideTwist has used HTTP GET and POST requests over port 443 for C2.[1]
Enterprise T1001 数据混淆

SideTwist can embed C2 responses in the source code of a fake Flickr webpage.[1]
Enterprise T1132 .001 数据编码: Standard Encoding

SideTwist has used Base64 for encoded C2 traffic.[1]
Enterprise T1083 文件和目录发现

SideTwist has the ability to search for specific files.[1]
Enterprise T1106 本机API

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.[1]
Enterprise T1082 系统信息发现

SideTwist can collect the computer name of a targeted system.[1]
Enterprise T1033 系统所有者/用户发现

SideTwist can collect the username on a targeted system.[1]
Enterprise T1016 系统网络配置发现

SideTwist has the ability to collect the domain name on a compromised host.[1]
Enterprise T1105 输入工具传输

SideTwist has the ability to download additional files.[1]
Enterprise T1041 通过C2信道渗出

SideTwist has exfiltrated data over its C2 channel.[1]

Groups That Use This Software

ID Name References
G0049 OilRig

[1]

References

  1. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.