Egregor
- ID
- S0554
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
Egregor is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between Egregor and Sekhmet ransomware, as well as Maze ransomware.[1][2][3]
Techniques used (25)
- T1027.002 Software Packing
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1039 Data from Network Shared Drive
- T1049 System Network Connections Discovery
- T1055 Process Injection
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1069.002 Domain Groups
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1197 BITS Jobs
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1219 Remote Access Tools
- T1484.001 Group Policy Modification
- T1486 Data Encrypted for Impact
- T1497 Virtualization/Sandbox Evasion
- T1497.003 Time Based Checks
- T1574.001 DLL
- T1685 Disable or Modify Tools