Malware: Mori

Description

[Mori](https://attack.mitre.org/software/S1047) is a backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)

External References

• mitre-attack
• CYBERCOM Iranian Intel Cyber January 2022
• DHS CISA AA22-055A MuddyWater February 2022

Techniques Used by This Malware

• T1001.001 — Junk Data
• T1012 — Query Registry
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1071.004 — DNS
• T1112 — Modify Registry
• T1132.001 — Standard Encoding
• T1140 — Deobfuscate/Decode Files or Information
• T1218.010 — Regsvr32

APT Groups Using This Malware

• MuddyWater