DEADWOOD
- ID
- S1134
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 27 Aug 2024
DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]
Techniques used (10)
- T1027.009 Embedded Payloads
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1485 Data Destruction
- T1531 Account Access Removal
- T1561.001 Disk Content Wipe
- T1561.002 Disk Structure Wipe
- T1569.002 Service Execution