S1169 Mango

malwareEnterprise

platformsWindows

also known asMango

Mango is a first-stage backdoor written in C#/.NET that was used by OilRig during the Juicy Mix campaign. Mango is the successor to Solar and includes additional exfiltration capabilities, the use of native APIs, and added detection evasion code.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1027.013Encrypted/Encoded File
T1033System Owner/User Discovery
T1041Exfiltration Over C2 Channel
T1053.005Scheduled Task
T1071.001Web Protocols
T1082System Information Discovery
T1083File and Directory Discovery
T1106Native API
T1132.001Standard Encoding
T1204.002Malicious File
T1573.001Symmetric Cryptography
T1573.002Asymmetric Cryptography
T1685Disable or Modify Tools

used by groups (1)

Threat groups associated with this.

G0049OilRig

used by campaigns (1)

Campaigns that use this.

C0044Juicy Mix

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan