Register to stream ATT&CKcon 2.0 October 29-30

EvilGrab

EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns. [1]

ID: S0152
Type: MALWARE
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1123 Audio Capture EvilGrab has the capability to capture audio from a victim machine. [1]
Enterprise T1043 Commonly Used Port EvilGrab uses port 8080 for C2. [1]
Enterprise T1056 Input Capture EvilGrab has the capability to capture keystrokes. [1]
Enterprise T1060 Registry Run Keys / Startup Folder EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence. [1]
Enterprise T1113 Screen Capture EvilGrab has the capability to capture screenshots. [1]
Enterprise T1125 Video Capture EvilGrab has the capability to capture video from a victim machine. [1]

Groups That Use This Software

ID Name References
G0045 menuPass [1]

References