Malware: QUADAGENT

Description

[QUADAGENT](https://attack.mitre.org/software/S0269) is a PowerShell backdoor used by [OilRig](https://attack.mitre.org/groups/G0049). (Citation: Unit 42 QUADAGENT July 2018)

External References

• mitre-attack
• Unit 42 QUADAGENT July 2018

Techniques Used by This Malware

• T1008 — Fallback Channels
• T1012 — Query Registry
• T1016 — System Network Configuration Discovery
• T1027.010 — Command Obfuscation
• T1027.011 — Fileless Storage
• T1033 — System Owner/User Discovery
• T1036.005 — Match Legitimate Resource Name or Location
• T1053.005 — Scheduled Task
• T1059.001 — PowerShell
• T1059.003 — Windows Command Shell
• T1059.005 — Visual Basic
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1071.004 — DNS
• T1112 — Modify Registry
• T1132.001 — Standard Encoding
• T1140 — Deobfuscate/Decode Files or Information

APT Groups Using This Malware

• OilRig