Malware

Mis-Type

Mis-Type is a Windows backdoor associated with post-compromise reconnaissance, command-and-control resilience, data staging, and data exfiltration. It communicates with operators using Base64-encoded traffic and can use a raw TCP socket as its primary command-and-control channel, with a fallback to an HTTP-based protocol and alternate server when the primary method fails. This dual-channel design supports continued operator access when network conditions or defenses disrupt one transport.

On infected systems, Mis-Type performs host and user-context discovery. Reported behaviors include determining the privilege level of the compromised user, collecting local network configuration information through commands such as ipconfig /all, and querying account information with net user. It temporarily stores collected information in local files before transmitting the results to command-and-control infrastructure, indicating a staged collection-and-exfiltration workflow.

Mis-Type also employs defense-evasion techniques. It has been observed injecting itself into legitimate running processes, including explorer.exe, and masquerading as a legitimate Windows component by saving itself under the name of a Microsoft service binary. Additional reported behavior includes creating a temporary local user account, which may support persistence or follow-on operator activity.

Overall, Mis-Type is best characterized as a Windows backdoor used for interactive post-exploitation, host reconnaissance, covert communications, and exfiltration, with process injection and masquerading used to reduce detection.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

1 technique

T1136Create AccountEvidence1

APT3 has been known to create or enable accounts, such as support_388945a0 . ... APT5 has created Local Administrator accounts to maintain access ... DarkGate creates a local user account, SafeMode, via net user commands.

Privilege Escalation

1 technique

T1055Process InjectionEvidence4

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

Stealth

3 techniques

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.005Match Legitimate Resource Name or LocationEvidence2

Akira has used legitimate names and locations for files to evade defenses.

T1055Process InjectionEvidence4

Discovery

5 techniques

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

T1033System Owner/User DiscoveryEvidence5

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

T1069Permission Groups DiscoveryEvidence3

Several entries describe identifying whether the current user has admin privileges, determining privilege level, identifying groups the user belongs to, or verifying execution as SYSTEM.

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1087Account DiscoveryEvidence1

“actors used the following commands… to enumerate user accounts: net user >> %temp%\download; net user /domain >> %temp%\download … APT1 used the commands net localgroup, net user, and net group to find accounts… APT32 enumerated administrative users using the commands net localgroup administrators … OilRig has run net user, net user /domain, net group "domain admins" /domain …”

Collection

2 techniques

T1005Data from Local SystemEvidence2

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

Command and Control

4 techniques

T1008Fallback ChannelsEvidence1

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

T1071.001Web ProtocolsEvidence4

Machete has sent data over HTTP if FTP failed. Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol. NETEAGLE will send beacons via an HTTP POST request if the infected host is configured to a proxy.

T1095Non-Application Layer ProtocolEvidence1

RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working. Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2. NETEAGLE will send beacons via UDP/6000 if no proxy is configured.

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.

ACTIVITY FEED

Recent activity

35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

35 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware observed being injected directly into running processes such as explorer.exe.

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that tests the privilege level of the compromised user.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Captures ipconfig /all output to a file for network configuration discovery.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that captures ipconfig /all output to a file for network configuration discovery.

+31 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Mis-Type