MITRE ATT&CKsoftware (malware)
S1037 STARWHALE
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- CANOPY
- Version
- 1.1
- Created
- 2022-08-18
Description
STARWHALE is Windows Script File (WSF) backdoor that has been used by MuddyWater, possibly since at least November 2021; there is also a STARWHALE variant written in Golang with similar capabilities. Security researchers have also noted the use of STARWHALE by UNC3313, which may be associated with MuddyWater.
Related
Uses · MITRE ATT&CK (14)
- T1027.013 Encrypted/Encoded File sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1074.001 Local Data Staging sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a DHS CISA AA22-055A MuddyWater February 2022
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage Mandiant UNC3313 Feb 2022