MITRE ATT&CKsoftware (malware)

S1043 ccf32

Published 2022-09-22 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2022-09-22

Description

ccf32 is data collection malware that has been used since at least February 2019, most notably during the FunnyDream campaign; there is also a similar x64 version.

Related

Uses · MITRE ATT&CK (12)

  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1074.002 Remote Data Staging sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1070.004 File Deletion sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1005 Data from Local System technique
  • T1083 File and Directory Discovery technique
  • T1119 Automated Collection technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • C0007 FunnyDream campaign

References