SideCopy has identified the country location of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

SideCopy has identified the IP address of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

SideCopy has utilized

SideCopy has executed malware by calling the API function

SideCopy has used a legitimate DLL file name,

SideCopy has used a malicious loader DLL file to execute the

SideCopy uses a loader DLL file to collect AV product names from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

SideCopy has sent spearphishing emails with malicious hta file attachments.(Citation: MalwareBytes SideCopy Dec 2021)|