Malware.View on attack.mitre.org
| Technique | Procedure example |
|---|---|
| T1001.001 Junk Data |
Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them. |
| T1105 Ingress Tool Transfer |
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers. |
| T1548.002 Bypass User Account Control |
Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database. |
| T1573.001 Symmetric Cryptography |
Downdelph uses RC4 to encrypt C2 responses. |
| T1574.001 DLL |
Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
