MgBot
- ID
- S1146
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 10 Oct 2024
MgBot is a modular malware framework exclusively associated with Daggerfly operations since at least 2012. MgBot was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.[1][2][3]
Techniques used (17)
- T1003 OS Credential Dumping
- T1005 Data from Local System
- T1018 Remote System Discovery
- T1025 Data from Removable Media
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1056.001 Keylogging
- T1057 Process Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1115 Clipboard Data
- T1123 Audio Capture
- T1213.006 Databases
- T1482 Domain Trust Discovery
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers