tool

Mango S1169

Type: malware
Platform: Windows
Created: 25 November 2024
Last modified: 25 November 2024

Mango is a first-stage backdoor written in C#/.NET that was used by OilRig during the Juicy Mix campaign. Mango is the successor to Solar and includes additional exfiltration capabilities, the use of native APIs, and added detection evasion code.[1]

Techniques57th pct

TacticsTop 20%

Threat groupunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MITRE reference S1169

Encrypted/Encoded File T1027.013↗

Mango contains a series of base64 encoded substrings.2

Stealth1 detection rules

System Owner/User Discovery T1033↗

Mango can collect the user name from a compromised system which is used to create a unique victim identifier.3

Discovery47 detection rules

Exfiltration Over C2 Channel T1041↗

Mango can use its HTTP C2 channel for exfiltration.4

Exfiltration16 detection rules

Scheduled Task T1053.005↗

Mango can create a scheduled task to run every 32 seconds to communicate with C2 and execute received commands.5

Execution · Persistence · Privilege Escalation79 detection rules

Web Protocols T1071.001↗

Mango can retrieve C2 commands sent in HTTP responses.6

Command and Control57 detection rules

System Information Discovery T1082↗

Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.7

Discovery54 detection rules

Standing S1169

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1357th pct

57th percentile · 57% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics8Top 20%

80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique29medTop 25%

75th percentile · 75% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique5med

Detection coverage S1169

642 distinct rules cover the 13 techniques recorded for this tool. The 660 technique-to-rule mappings resolve to 642 distinct rules, because one rule can cover several techniques. 407 Sigma · 235 Splunk.

12 covered by at least one rule1 with no coverage642 distinct rules in total

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs

© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org

MITRE reference S1169

Reach

Coverage

How it got here