1. Home
  2. Software
  3. TAMECAT

TAMECAT

TAMECAT is a malware that is used by APT42 to execute PowerShell or C# content.[1]

ID: S1193
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 08 January 2025
Last Modified: 08 January 2025
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

TAMECAT has used HTTP for C2 communications.[1]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

TAMECAT has used PowerShell to download and run additional content.[1]

.003 Command and Scripting Interpreter: Windows Command Shell

TAMECAT has used cmd.exe to run the curl command.[1]

.005 Command and Scripting Interpreter: Visual Basic

TAMECAT has used VBScript to query anti-virus products.[1]

Enterprise T1132 .001 Data Encoding: Standard Encoding

TAMECAT has encoded C2 traffic with Base64.[1]

Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

TAMECAT has used AES to encrypt C2 traffic.[1]
Enterprise T1105 Ingress Tool Transfer

TAMECAT has used wget and curl to download additional content.[1]

Enterprise T1518 .001 Software Discovery: Security Software Discovery

TAMECAT has used Windows Management Instrumentation (WMI) to check for anti-virus products.[1]

Enterprise T1047 Windows Management Instrumentation

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.[1]

Groups That Use This Software

ID Name References
G1044 APT42

[1]

References

  1. Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.