1. Home
  2. Software
  3. Mafalda

Mafalda

Mafalda is a flexible interactive implant that has been used by Metador. Security researchers assess the Mafalda name may be inspired by an Argentinian cartoon character that has been popular as a means of political commentary since the 1960s. [1]

ID: S1060
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Massimiliano Romano, BT Security
Version: 1.1
Created: 26 January 2023
Last Modified: 11 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

Mafalda can collect files and information from a compromised host.[1]
Enterprise T1090 .001 代理: Internal Proxy

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.[2]
Enterprise T1112 修改注册表

Mafalda can manipulate the system registry on a compromised host.[2]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

Mafalda can encrypt its C2 traffic with RC4.[1]
Enterprise T1140 反混淆/解码文件或信息

Mafalda can decrypt files and data.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

Mafalda can execute PowerShell commands on a compromised machine.[2]
.003 命令与脚本解释器: Windows Command Shell

Mafalda can execute shell commands using cmd.exe.[2]
Enterprise T1133 外部远程服务

Mafalda can establish an SSH connection from a compromised host to a server.[2]
Enterprise T1113 屏幕捕获

Mafalda can take a screenshot of the target machine and save it to a file.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Mafalda can use HTTP for C2.[1]
Enterprise T1003 .001 操作系统凭证转储: LSASS Memory

Mafalda can dump password hashes from LSASS.exe.[2]
Enterprise T1074 .001 数据分段: Local Data Staging

Mafalda can place retrieved files into a destination directory.[1]
Enterprise T1132 .001 数据编码: Standard Encoding

Mafalda can encode data using Base64 prior to exfiltration.[2]
Enterprise T1083 文件和目录发现

Mafalda can search for files and directories.[1]
Enterprise T1552 .004 未加密凭证: Private Keys

Mafalda can collect a Chrome encryption key used to protect browser cookies.[1]
Enterprise T1106 本机API

Mafalda can use a variety of API calls.[1]
Enterprise T1012 查询注册表

Mafalda can enumerate Registry keys with all subkeys and values.[2]
Enterprise T1205 .001 流量激活: Port Knocking

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.[1][2]
Enterprise T1217 浏览器信息发现

Mafalda can collect the contents of the %USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState file.[1]

Enterprise T1027 .013 混淆文件或信息: Encrypted/Encoded File

Mafalda has been obfuscated and contains encrypted functions.[1]
Enterprise T1070 .001 移除指标: Clear Windows Event Logs

Mafalda can delete Windows Event logs by invoking the OpenEventLogW and ClearEventLogW functions.[1]
Enterprise T1082 系统信息发现

Mafalda can collect the computer name and enumerate all drives on a compromised host.[1][2]
Enterprise T1033 系统所有者/用户发现

Mafalda can collect the username from a compromised host.[2]
Enterprise T1569 .002 系统服务: Service Execution

Mafalda can create a remote service, let it run once, and then delete it.[2]
Enterprise T1049 系统网络连接发现

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.[1]
Enterprise T1016 系统网络配置发现

Mafalda can use the GetAdaptersInfo function to retrieve information about network adapters and the GetIpNetTable function to retrieve the IPv4 to physical network address mapping table.[1]
Enterprise T1134 访问令牌操控

Mafalda can use AdjustTokenPrivileges() to elevate privileges.[2]
.003 Make and Impersonate Token

Mafalda can create a token for a different user.[2]
Enterprise T1622 调试器规避

Mafalda can search for debugging tools on a compromised host.[2]
Enterprise T1518 .001 软件发现: Security Software Discovery

Mafalda can search for a variety of security software programs, EDR systems, and malware analysis tools.[1][2]
Enterprise T1105 输入工具传输

Mafalda can download additional files onto the compromised host.[2]
Enterprise T1056 输入捕获

Mafalda can conduct mouse event logging.[2]
Enterprise T1057 进程发现

Mafalda can enumerate running processes on a machine.[1]
Enterprise T1041 通过C2信道渗出

Mafalda can send network system data and files to its C2 server.[1]
Enterprise T1095 非应用层协议

Mafalda can use raw TCP for C2.[1]

Groups That Use This Software

ID Name References
G1013 Metador

[1][2]

References

  1. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
  1. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.