Malware

SPACESHIP

SPACESHIP is a Windows malware family associated with collection and exfiltration activity, particularly in environments where removable media is used. It has been documented establishing persistence through boot or logon autostart mechanisms, including use of the Startup folder and shortcut modification. SPACESHIP performs file and directory discovery, identifies files of interest by extension, and copies selected data into a staging location within the user profile. It can archive collected data using a custom method before exfiltration. A notable characteristic is exfiltration over USB or other physical removable media rather than relying solely on network channels. The malware is part of a cluster of related implants that emphasize persistence, local staging, and removable-media-based collection workflows on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

T1547.001Registry Run Keys / Startup FolderEvidence7

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

T1547.009Shortcut ModificationEvidence3

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.

Privilege Escalation

3 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence7

T1547.009Shortcut ModificationEvidence3

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

3 techniques

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

T1560.003Archive via Custom MethodEvidence1

Exfiltration

1 technique

T1052.001Exfiltration over USBEvidence1

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that persists by creating a shortcut in the current user's Startup folder.

mitre attack websiteNews

Jan 1, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Backdoor malware that persists by creating a shortcut in the user's Startup folder.

mitre attack websiteNews

May 20, 2015

APT30, Group G0013 | MITRE ATT&CK®

Data theft malware that archives and stages collected data locally, persists via registry run keys and shortcut modification, performs file and directory discovery, and exfiltrates data over USB.

mitre attack websiteNews

May 20, 2015

Data Staged: Local Data Staging, Sub-technique T1074.001 - Enterprise | MITRE ATT&CK®

Backdoor that collects targeted file types and stages them in a user profile directory.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SPACESHIP