CARROTBALL is an FTP downloader utility that has been in use since at least 2019. CARROTBALL has been used as a downloader to install SYSCON.
| Technique | Procedure example |
|---|---|
| T1027 Obfuscated Files or Information |
CARROTBALL has used a custom base64 alphabet to decode files. |
| T1071.002 File Transfer Protocols |
CARROTBALL has the ability to use FTP in C2 communications. |
| T1105 Ingress Tool Transfer |
CARROTBALL has the ability to download and install a remote payload. |
| T1204.002 Malicious File |
CARROTBALL has been executed through users being lured into opening malicious e-mail attachments. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
