S0046 CozyCar

malwareEnterprise

platformsWindows

also known asCozyCar · CozyDuke · CozyBear · Cozer · EuroAPT

CozyCar is malware that was used by APT29 from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality.

techniques used (14)

ATT&CK techniques this enables or maps to.

T1003.001LSASS Memory
T1003.002Security Account Manager
T1027.013Encrypted/Encoded File
T1036.003Rename Legitimate Utilities
T1053.005Scheduled Task
T1059.003Windows Command Shell
T1071.001Web Protocols
T1082System Information Discovery
T1102.002Bidirectional Communication
T1218.011Rundll32
T1497Virtualization/Sandbox Evasion
T1518.001Security Software Discovery
T1543.003Windows Service
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G0016APT29

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan