Skip to content

S0083 Misdat

Misdat is a backdoor that was used in Operation Dust Storm from 2010 to 2011.1

Item Value
ID S0083
Associated Names
Type MALWARE
Version 1.2
Created 31 May 2017
Last Modified 30 September 2022
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1547 Boot or Logon Autostart Execution Misdat has created registry keys for persistence, including HKCU\Software\dnimtsoleht\StubPath, HKCU\Software\snimtsOleht\StubPath, HKCU\Software\Backtsaleht\StubPath, HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}, and HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell Misdat is capable of providing shell functionality to the attacker to execute commands.1
enterprise T1132 Data Encoding -
enterprise T1132.001 Standard Encoding Misdat network traffic is Base64-encoded plaintext.1
enterprise T1005 Data from Local System Misdat has collected files and data from a compromised host.1
enterprise T1041 Exfiltration Over C2 Channel Misdat has uploaded files and data to its C2 servers.1
enterprise T1083 File and Directory Discovery Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.1
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion Misdat is capable of deleting the backdoor file.1
enterprise T1070.006 Timestomp Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.1
enterprise T1070.009 Clear Persistence Misdat is capable of deleting Registry keys used for persistence.1
enterprise T1105 Ingress Tool Transfer Misdat is capable of downloading files from the C2.1
enterprise T1036 Masquerading -
enterprise T1036.005 Match Legitimate Name or Location Misdat saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.12
enterprise T1106 Native API Misdat has used Windows APIs, including ExitWindowsEx and GetKeyboardType.1
enterprise T1095 Non-Application Layer Protocol Misdat network traffic communicates over a raw socket.1
enterprise T1027 Obfuscated Files or Information -
enterprise T1027.002 Software Packing Misdat was typically packed using UPX.1
enterprise T1082 System Information Discovery The initial beacon packet for Misdat contains the operating system version of the victim.1
enterprise T1614 System Location Discovery -
enterprise T1614.001 System Language Discovery Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call GetKeyboardType.1

References

  1. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  2. Microsoft. (2011, January 12). Distributed Transaction Coordinator. Retrieved February 25, 2016. ↩