ATT&CK SoftwareOLDBAIT

OLDBAIT

S0138

Malware.View on attack.mitre.org

About this malware

OLDBAIT is a credential harvester used by APT28.

Techniques used6

Stealth2

T1027Obfuscated Files or Information T1036.005Match Legitimate Resource Name or Location

Credential Access2

T1555Credentials from Password Stores T1555.003Credentials from Web Browsers

Command and Control2

T1071.001Web Protocols T1071.003Mail Protocols

Procedure examples6

Technique	Procedure example
T1027 Obfuscated Files or Information	OLDBAIT obfuscates internal strings and unpacks them at startup. FireEye APT28
T1036.005 Match Legitimate Resource Name or Location	OLDBAIT installs itself in `%ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe`; the directory name is missing a space and the file name is missing the letter "o." FireEye APT28
T1071.001 Web Protocols	OLDBAIT can use HTTP for C2. FireEye APT28
T1071.003 Mail Protocols	OLDBAIT can use SMTP for C2. FireEye APT28
T1555 Credentials from Password Stores	OLDBAIT collects credentials from several email clients. FireEye APT28
T1555.003 Credentials from Web Browsers	OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora. FireEye APT28

Groups that use it1

Campaigns0

None recorded.

References2

FireEye APT28 Open source
FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.
FireEye APT28 January 2017 Open source
FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.