Malware: Net Crawler

Description

[Net Crawler](https://attack.mitre.org/software/S0056) is an intranet worm capable of extracting credentials using credential dumpers and spreading to systems on a network over SMB by brute forcing accounts with recovered passwords and using [PsExec](https://attack.mitre.org/software/S0029) to execute a copy of [Net Crawler](https://attack.mitre.org/software/S0056). (Citation: Cylance Cleaver)

External References

• mitre-attack
• Cylance Cleaver

Techniques Used by This Malware

• T1003.001 — LSASS Memory
• T1021.002 — SMB/Windows Admin Shares
• T1110.002 — Password Cracking
• T1569.002 — Service Execution

APT Groups Using This Malware

• Cleaver