defection.io

malware

HAMMERTOSS S0037

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

HAMMERTOSS is a backdoor that was used by APT29 in 2015. [1] [2]

Techniques33rd pct

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

HAMMERTOSS S0037

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

HAMMERTOSS is a backdoor that was used by APT29 in 2015. [1] [2]

Techniques33rd pct

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

HAMMERTOSS MITRE reference S0037

Steganography T1001.002 ↗

HAMMERTOSS is controlled via commands that are appended to image files.3

Command and Controlno detection rules

PowerShell T1059.001 ↗

HAMMERTOSS is known to use PowerShell.4

Execution300 detection rules

Web Protocols T1071.001 ↗

The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.5

Command and Control60 detection rules

One-Way Communication T1102.003 ↗

The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.6

Command and Control2 detection rules

Hidden Window T1564.003 ↗

HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.7

Stealth11 detection rules

Exfiltration to Cloud Storage T1567.002 ↗

HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.8

Exfiltration20 detection rules

Standing S0037

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques733rd pct

33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique11medBottom 19%

19th percentile · 81% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique3medBottom 16%

16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 7 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 292Splunk ESCU (cumulative) · 94