Rancor - G0075

Created: 2018-10-17T00:14:20.652Z

Modified: 2020-03-30T19:15:49.217Z

Contributors:

Aliases

Rancor

Description

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)

Techniques Used

Rancor has used VBS scripts as well as embedded macros for execution.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.007|Msiexec|

Rancor has used

Rancor has used HTTP for C2.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Rancor has used cmd.exe to execute commmands.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Rancor has downloaded additional malware, including by using

certutil.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Rancor has attached a malicious document to an email to gain initial access.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Rancor launched a scheduled task to gain persistence using the