Forensia CTI Core

About

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW. Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.

Platforms: Linux, macOS, WindowsParent: T1027 Obfuscated Files or InformationMITRE ATT&CK ↗

Used by actors

4 known groups

G0047 Gamaredon Group G0069 MuddyWater G0106 Rocke G1041 Sea Turtle

Software

6 malware/tools implement this

Cardinal RATnjRATSliverFoggyWebDarkWatchmanSamurai

Corpus indicators tagged with this technique

106 indicators in the corpus carry T1027.004.

Indicator	Type	Family	Sev	Src
63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae	sha256	—	80	2
2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc	sha256	—	80	2
9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2	sha256	—	80	2
1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd	sha256	—	80	2
49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd	sha256	—	80	2
89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028	sha256	—	80	2
f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14	sha256	—	80	2
da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291c	sha256	—	80	2
6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9	sha256	—	80	2
c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5	sha256	—	80	2
b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea	sha256	—	80	2
98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8	sha256	—	80	2
bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9	sha256	—	80	2
97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f	sha256	—	80	2
83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7	sha256	—	80	2
04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1	sha256	—	80	2
1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a	sha256	—	80	2
06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969	sha256	—	80	2
3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44	sha256	—	80	2
ff4edf35349eb7af8edc60f01eede469bee54efb	sha1	—	78	1
b77835ab95bd5c25472fa352c5204cf15ab42d09	sha1	—	78	1
9db9b3e55f58553735a25db6702d272cf48495ea	sha1	—	78	1
29e3cd6c5f1d8a7ad0ce9a4bb5d6e95e6bc33010	sha1	—	78	1
25908558764390958596189327204542	md5	—	76	2
0e5be13d3339b4b2561e5d88127e1bd3	md5	—	76	1
01eb459a28a329aaf6b5fa6fc5acdc7e	md5	—	76	1
c2d5d410a37d0c51546b1ef4962aff57	md5	—	76	1
17082531775760189576112827972435	md5	—	76	2
ba8600d349779c4ba0ea37da2e109f11	md5	—	76	1
193.202.84.32	ip	—	70	2

Showing the top 30 by severity of 106.