MITRE ATT&CKsoftware (tool)
S1050 PcShare
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-10-13
Description
PcShare is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.
Related
Uses · MITRE ATT&CK (21)
- T1027.015 Compression sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1546.015 Component Object Model Hijacking sub-technique
- T1071.001 Web Protocols sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1056.001 Keylogging sub-technique
- T1036.001 Invalid Code Signature sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1218.011 Rundll32 sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1055 Process Injection technique
- T1057 Process Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
- T1113 Screen Capture technique
- T1125 Video Capture technique
References
- https://github.com/LiveMirror/pcshare GitHub PcShare 2014
- https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf Bitdefender FunnyDream Campaign November 2020