EvilGrab

EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns. [1]

ID: S0152
Type: MALWARE
Platforms: Windows
Version: 1.0

Techniques Used

Domain ID Name Use
Enterprise T1123 Audio Capture EvilGrab has the capability to capture audio from a victim machine.[1]
Enterprise T1043 Commonly Used Port EvilGrab uses port 8080 for C2.[1]
Enterprise T1056 Input Capture EvilGrab has the capability to capture keystrokes.[1]
Enterprise T1060 Registry Run Keys / Startup Folder EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.[1]
Enterprise T1113 Screen Capture EvilGrab has the capability to capture screenshots.[1]
Enterprise T1125 Video Capture EvilGrab has the capability to capture video from a victim machine.[1]

Groups

Groups that use this software:

menuPass

References