Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1027.013 Encrypted/Encoded File |
MalwareMicropsia | Micropsia obfuscates the configuration with a custom Base64 and XOR. |
| T1047 Windows Management Instrumentation |
MalwareMicropsia | Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI. |
| T1056.001 Keylogging |
MalwareMicropsia | Micropsia has keylogging capabilities. |
| T1059.003 Windows Command Shell |
MalwareMicropsia | Micropsia creates a command-line shell using cmd.exe. |
| T1071.001 Web Protocols |
MalwareMicropsia | Micropsia uses HTTP and HTTPS for C2 network communications. |
| T1082 System Information Discovery |
MalwareMicropsia | Micropsia gathers the hostname and OS version from the victim’s machine. |
| T1083 File and Directory Discovery |
MalwareMicropsia | Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths. |
| T1105 Ingress Tool Transfer |
MalwareMicropsia | Micropsia can download and execute an executable from the C2 server. |
| T1113 Screen Capture |
MalwareMicropsia | Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API. |
| T1119 Automated Collection |
MalwareMicropsia | Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt). |
| T1123 Audio Capture |
MalwareMicropsia | Micropsia can perform microphone recording. |
| T1518.001 Security Software Discovery |
MalwareMicropsia | Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI. |
| T1560.001 Archive via Utility |
MalwareMicropsia | Micropsia creates a RAR archive based on collected files on the victim's machine. |
| T1564.001 Hidden Files and Directories |
MalwareMicropsia | Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
