MITRE ATT&CKsoftware (malware)
S0284 More_eggs
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- SKID, Terra Loader, SpicyOmelette
- Version
- 3.1
- Created
- 2018-10-17
Description
More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4.
Related
Uses · MITRE ATT&CK (15)
- T1027.013 Encrypted/Encoded File sub-technique
- T1016.001 Internet Connection Discovery sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1218.010 Regsvr32 sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf Crowdstrike GTR2020 Mar 2020
- https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/ ESET EvilNum July 2020
- https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html Talos Cobalt Group July 2018
- https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/ Security Intelligence More Eggs Aug 2019
- https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf Visa FIN6 Feb 2019