ATT&CK SoftwareMURKYTOP

MURKYTOP

S0233

Malware.View on attack.mitre.org

About this malware

MURKYTOP is a reconnaissance tool used by Leviathan.

Techniques used9

Execution2

T1053.002At T1059.003Windows Command Shell

Persistence1

Privilege Escalation1

Stealth1

T1070.004File Deletion

Discovery6

T1018Remote System Discovery T1046Network Service Discovery T1069Permission Groups Discovery T1082System Information Discovery T1087.001Local Account T1135Network Share Discovery

Procedure examples9

Technique	Procedure example
T1018 Remote System Discovery	MURKYTOP has the capability to identify remote hosts on connected networks. FireEye Periscope March 2018
T1046 Network Service Discovery	MURKYTOP has the capability to scan for open ports on hosts in a connected network. FireEye Periscope March 2018
T1053.002 At	MURKYTOP has the capability to schedule remote AT jobs. FireEye Periscope March 2018
T1059.003 Windows Command Shell	MURKYTOP uses the command-line interface. FireEye Periscope March 2018
T1069 Permission Groups Discovery	MURKYTOP has the capability to retrieve information about groups. FireEye Periscope March 2018
T1070.004 File Deletion	MURKYTOP has the capability to delete local files. FireEye Periscope March 2018
T1082 System Information Discovery	MURKYTOP has the capability to retrieve information about the OS. FireEye Periscope March 2018
T1087.001 Local Account	MURKYTOP has the capability to retrieve information about users on remote hosts. FireEye Periscope March 2018
T1135 Network Share Discovery	MURKYTOP has the capability to retrieve information about shares on remote hosts. FireEye Periscope March 2018

Groups that use it1

Campaigns0

None recorded.

References1

FireEye Periscope March 2018 Open source
FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.