Malware.View on attack.mitre.org
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL.
| Technique | Procedure example |
|---|---|
| T1020 Automated Exfiltration |
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine. |
| T1025 Data from Removable Media |
Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim. |
| T1027.013 Encrypted/Encoded File |
Most strings in USBStealer are encrypted using 3DES and XOR and reversed. |
| T1036.005 Match Legitimate Resource Name or Location |
USBStealer mimics a legitimate Russian program called USB Disk Security. |
| T1052.001 Exfiltration over USB |
USBStealer exfiltrates collected files via removable media from air-gapped victims. |
| T1070.004 File Deletion |
USBStealer has several commands to delete files associated with the malware from the victim. |
| T1070.006 Timestomp |
USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system. |
| T1074.001 Local Data Staging |
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration. |
| T1083 File and Directory Discovery |
USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names. |
| T1091 Replication Through Removable Media |
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system. |
| T1092 Communication Through Removable Media |
USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim. |
| T1119 Automated Collection |
For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration. |
| T1120 Peripheral Device Discovery |
USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system. |
| T1547.001 Registry Run Keys / Startup Folder |
USBStealer registers itself under a Registry Run key with the name "USB Disk Security." |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
