Malware

Explosive

Explosive is a Windows malware family associated with post-compromise collection, surveillance, and persistence behaviors. Observed capabilities include collecting host profiling data such as the current username and the victim machine’s MAC address, interacting with the Windows clipboard through OpenClipboard-based functionality, and scanning executable files present on USB drives. It also employs defense-evasion and persistence-related techniques by setting files and paths to hidden attributes and writing itself into Windows Registry values. Its command-and-control communications have been observed using RC4 encryption. Explosive has also been reported with keylogging capability, including use against administrator accounts on target servers. The combination of host discovery, clipboard access, keylogging, removable-media scanning, registry-based persistence, and encrypted communications is consistent with an espionage-oriented implant operating on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

1 technique

T1112Modify RegistryEvidence7

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Stealth

1 technique

T1564.001Hidden Files and DirectoriesEvidence3

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Defense Impairment

1 technique

T1112Modify RegistryEvidence7

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

T1033System Owner/User DiscoveryEvidence6

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

T1082System Information DiscoveryEvidence7

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

Collection

3 techniques

T1025Data from Removable MediaEvidence2

AppleSeed can find and collect data from removable media devices. APT28 backdoor may collect the entire contents of an inserted USB device. Aria-body has the ability to collect data from USB devices. BADNEWS copies files with certain extensions from USB devices to a predefined directory.

T1056.001KeyloggingEvidence1

T1115Clipboard DataEvidence3

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

T1573.001Symmetric CryptographyEvidence1

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that collects the username from the infected host.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Collects MAC addresses from victim machines.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that includes functionality to access the clipboard via an OpenClipboard wrapper.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Collects the username from the infected host.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Explosive