MalwareUsed by 1 actorExploits 1 CVE

EvilGrab

EvilGrab is a Windows remote access trojan associated with China-linked espionage activity, particularly APT10. It has been used as tactical malware for initial compromise and early foothold establishment, including in spearphishing operations delivering malicious Microsoft Office documents and in at least one observed case exploiting CVE-2012-0158. EvilGrab supports surveillance and collection functions including screenshot capture, keystroke logging, audio capture, and video capture from infected systems. It is also capable of maintaining persistence through Windows Registry Run key modification. In reported APT10 operations, EvilGrab formed part of a broader intrusion toolkit alongside malware such as ChChes and RedLeaves, with use against managed service providers, Japanese organizations, and other espionage targets. Its functionality and operational role are consistent with a collection-oriented espionage implant designed to establish access, monitor victims, and support follow-on compromise activity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

The title of the lure was “2016年台灣總統選舉觀戰團行程20160105.xls” which translates to “2016 Taiwan president election watching group schedule”. Once the spreadsheet is opened, CVE-2012-0158 is exploited and a file called 6EC5.tmp is dropped in the %TEMP% folder. | We have observed the EvilGrab, ChChes and RedLeaves malware families used as the primary method for initial exploitation to gain entry to the victim... EvilGrab, as per its name, has the capability to “grab” audio, video and screenshots of infected hosts and send the captured media to command and control servers.

via web archiveweb.archive.org

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

menuPass

We have observed the EvilGrab, ChChes and RedLeaves malware families used as the primary method for initial exploitation to gain entry to the victim... EvilGrab, as per its name, has the capability to “grab” audio, video and screenshots of infected hosts and send the captured media to command and control servers.

via web archiveweb.archive.org

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Often deployed via spear phishing, they are lightweight, have particular capabilities and are designed to facilitate system identification and lateral movement.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

Once the spreadsheet is opened, CVE-2012-0158 is exploited and a file called 6EC5.tmp is dropped in the %TEMP% folder.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

T1547.001Registry Run Keys / Startup FolderEvidence8

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

It attempts to inject into running processes, focussing on security products and native Windows processes.

T1547.001Registry Run Keys / Startup FolderEvidence8

Stealth

1 technique

T1055Process InjectionEvidence1

It attempts to inject into running processes, focussing on security products and native Windows processes.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.

Credential Access

1 technique

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Collection

4 techniques

T1056.001KeyloggingEvidence2

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1123Audio CaptureEvidence1

T1125Video CaptureEvidence2

Agent Tesla can access the victim’s webcam and record video. AsyncRAT can record screen content on targeted systems. Bandook has modules that are capable of capturing video from a victim's webcam. ... ZxShell has a command to perform video device spying.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

The debug messages visible in the output show another unusual feature of the malware – the use of HEAD requests

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Malware that persists by adding a Registry Run key masquerading as ctfmon.exe.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Remote access trojan with screenshot capture capability.

mitre attack websiteNews

Jan 1, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Remote access trojan with screenshot capture capability.

mitre attack websiteNews

Jan 1, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Remote access trojan that persists by adding a Run key masquerading as ctfmon.exe.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

EvilGrab