Malware: Egregor

Description

[Egregor](https://attack.mitre.org/software/S0554) is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between [Egregor](https://attack.mitre.org/software/S0554) and Sekhmet ransomware, as well as [Maze](https://attack.mitre.org/software/S0449) ransomware.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cyble Egregor Oct 2020)(Citation: Security Boulevard Egregor Oct 2020)

External References

• mitre-attack
• NHS Digital Egregor Nov 2020
• Cyble Egregor Oct 2020
• Security Boulevard Egregor Oct 2020

Techniques Used by This Malware

• T1027.002 — Software Packing
• T1033 — System Owner/User Discovery
• T1036.004 — Masquerade Task or Service
• T1039 — Data from Network Shared Drive
• T1049 — System Network Connections Discovery
• T1055 — Process Injection
• T1059.001 — PowerShell
• T1059.003 — Windows Command Shell
• T1069.002 — Domain Groups
• T1071.001 — Web Protocols
• T1082 — System Information Discovery
• T1105 — Ingress Tool Transfer
• T1106 — Native API
• T1124 — System Time Discovery
• T1140 — Deobfuscate/Decode Files or Information
• T1197 — BITS Jobs
• T1218.010 — Regsvr32
• T1218.011 — Rundll32
• T1219 — Remote Access Tools
• T1484.001 — Group Policy Modification
• T1486 — Data Encrypted for Impact
• T1497 — Virtualization/Sandbox Evasion
• T1497.003 — Time Based Evasion
• T1562.001 — Disable or Modify Tools
• T1574.001 — DLL