WIRTE

Names and who uses them

• WIRTEOur name
• Ashen LepusPalo Alto Networks

Targets

Sectors: Defence, Finance, Legal, Diplomatic

Regions: Europe, Middle East, Africa, Israel

Known techniques

• T1027.010Command Obfuscation
• T1027.015Compression
• T1036.005Match Legitimate Resource Name or Location
• T1041Exfiltration Over C2 Channel
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1071.001Web Protocols
• T1074.001Local Data Staging
• T1105Ingress Tool Transfer
• T1106Native API
• T1114.001Local Email Collection
• T1140Deobfuscate/Decode Files or Information
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.010Regsvr32
• T1497.001System Checks
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1571Non-Standard Port
• T1574.001DLL
• T1583.001Domains
• T1586.002Email Accounts
• T1588.002Tool
• T1608.001Upload Malware
• T1684.001Impersonation

Malware and tools used