Woody RAT
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1005 | 从本地系统获取数据 |
Woody RAT can collect information from a compromised host.[1] |
|
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography |
Woody RAT can use AES-CBC to encrypt data sent to its C2 server.[1] |
| .002 | 加密通道: Asymmetric Cryptography |
Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.[1] |
||
| Enterprise | T1140 | 反混淆/解码文件或信息 |
Woody RAT can deobfuscate Base64-encoded strings and scripts.[1] |
|
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
Woody RAT can execute PowerShell commands and scripts with the use of .NET DLL, |
| .003 | 命令与脚本解释器: Windows Command Shell | |||
| Enterprise | T1562 | .006 | 妨碍防御: Indicator Blocking |
Woody RAT has suppressed all error reporting by calling |
| Enterprise | T1203 | 客户端执行漏洞利用 |
Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.[1] |
|
| Enterprise | T1113 | 屏幕捕获 |
Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.[1] |
|
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols |
Woody RAT can communicate with its C2 server using HTTP requests.[1] |
| Enterprise | T1083 | 文件和目录发现 |
Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.[1] |
|
| Enterprise | T1106 | 本机API |
Woody RAT can use multiple native APIs, including |
|
| Enterprise | T1012 | 查询注册表 |
Woody RAT can search registry keys to identify antivirus programs on an compromised host.[1] |
|
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File | |
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
Woody RAT has relied on users opening a malicious email attachment for execution.[1] |
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Woody RAT has the ability to delete itself from disk by creating a suspended notepad process and writing shellcode to delete a file into the suspended process using |
| Enterprise | T1082 | 系统信息发现 |
Woody RAT can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, environment variables, and storage drives.[1] |
|
| Enterprise | T1033 | 系统所有者/用户发现 |
Woody RAT can retrieve a list of user accounts and usernames from an infected machine.[1] |
|
| Enterprise | T1016 | 系统网络配置发现 |
Woody RAT can retrieve network interface and proxy information.[1] |
|
| .001 | Internet Connection Discovery |
Woody RAT can make |
||
| Enterprise | T1087 | 账号发现 |
Woody RAT can identify administrator accounts on an infected machine.[1] |
|
| Enterprise | T1518 | 软件发现 |
Woody RAT can collect .NET, PowerShell, and Python information from an infected host.[1] |
|
| .001 | Security Software Discovery |
Woody RAT can detect Avast Software, Doctor Web, Kaspersky, AVG, ESET, and Sophos antivirus programs.[1] |
||
| Enterprise | T1105 | 输入工具传输 |
Woody RAT can download files from its C2 server, including the .NET DLLs, |
|
| Enterprise | T1057 | 进程发现 |
Woody RAT can call |
|
| Enterprise | T1055 | 进程注入 |
Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.[1] |
|
| .012 | Process Hollowing |
Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using |
||
| Enterprise | T1041 | 通过C2信道渗出 |
Woody RAT can exfiltrate files from an infected machine to its C2 server.[1] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
Woody RAT has been delivered via malicious Word documents and archive files.[1] |