ATT&CK ReferencesUnit 42 SeaDuke 2015

Unit 42 SeaDuke 2015

Grunzweig, J.. (2015, July 14). Unit 42 Technical Analysis: Seaduke. Retrieved August 3, 2016.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1027.002 Software Packing	MalwareSeaDuke	SeaDuke has been packed with the UPX packer. Unit 42 SeaDuke 2015
T1059.003 Windows Command Shell	MalwareSeaDuke	SeaDuke is capable of executing commands. Unit 42 SeaDuke 2015
T1105 Ingress Tool Transfer	MalwareSeaDuke	SeaDuke is capable of uploading and downloading files. Unit 42 SeaDuke 2015
T1132.001 Standard Encoding	MalwareSeaDuke	SeaDuke C2 traffic is base64-encoded. Unit 42 SeaDuke 2015
T1547.001 Registry Run Keys / Startup Folder	MalwareSeaDuke	SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory. Unit 42 SeaDuke 2015
T1547.009 Shortcut Modification	MalwareSeaDuke	SeaDuke is capable of persisting via a .lnk file stored in the Startup directory. Unit 42 SeaDuke 2015
T1573.001 Symmetric Cryptography	MalwareSeaDuke	SeaDuke C2 traffic has been encrypted with RC4 and AES. Mandiant No Easy Breach Unit 42 SeaDuke 2015

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.