MITRE ATT&CKsoftware (malware)
S0459 MechaFlounder
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-05-27
Description
MechaFlounder is a python-based remote access tool (RAT) that has been used by APT39. The payload uses a combination of actor developed code and code snippets freely available online in development communities.
Related
Uses · MITRE ATT&CK (8)
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.006 Python sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0087 APT39 group
References
- https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/ Unit 42 MechaFlounder March 2019