MITRE ATT&CKsoftware (malware)

S0462 CARROTBAT

Published 2020-06-02 Modified 2024-04-11 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.2
Created: 2020-06-02

Description

CARROTBAT is a customized dropper that has been in use since at least 2017. CARROTBAT has been used to install SYSCON and has infrastructure overlap with KONNI.

Uses · MITRE ATT&CK (6)

T1027.013 Encrypted/Encoded File sub-technique
T1027.010 Command Obfuscation sub-technique
T1059.003 Windows Command Shell sub-technique
T1070.004 File Deletion sub-technique
T1082 System Information Discovery technique
T1105 Ingress Tool Transfer technique

References

https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/ Unit 42 CARROTBAT November 2018
https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ Unit 42 CARROTBAT January 2020

S0462 CARROTBAT

Description

Related

Uses · MITRE ATT&CK (6)

References