MITRE ATT&CKsoftware (malware)

S0669 KOCTOPUS

Published 2021-12-06 Modified 2024-11-17 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2021-12-06

Description

KOCTOPUS's batch variant is loader used by LazyScripter since 2018 to launch Octopus and Koadic and, in some cases, QuasarRAT. KOCTOPUS also has a VBA variant that has the same functionality as the batch version.

Related

Uses · MITRE ATT&CK (20)

  • T1685 Disable or Modify Tools technique
  • T1027.010 Command Obfuscation sub-technique
  • T1070.009 Clear Persistence sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1082 System Information Discovery technique
  • T1090 Proxy technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (1)

  • G0140 LazyScripter group

References