17eb2a0fc25c46155d3bfa12e20e42e63e442cdb00b5ab5d33a64b36bf2d8d5c | Triage™

Login
Reports

Overview

overview

7

Static

static

3

recoil.clu...ne.exe

windows10-2004-x64

7

recoil.clu...ne.exe

windows11-ltsc_2024-x64

7

recoil.clu...ACK.sh

ubuntu-18.04-amd64

1

recoil.clu...ACK.sh

debian-9-armhf

1

recoil.clu...ACK.sh

debian-9-mips

1

recoil.clu...ACK.sh

debian-9-mipsel

1

recoil.clu...ery.py

windows10-2004-x64

3

recoil.clu...ery.py

windows11-ltsc_2024-x64

3

recoil.clu...iew.js

windows10-2004-x64

3

recoil.clu...iew.js

windows11-ltsc_2024-x64

3

recoil.clu...ACK.sh

ubuntu-18.04-amd64

1

recoil.clu...ACK.sh

debian-9-armhf

1

recoil.clu...ACK.sh

debian-9-mips

1

recoil.clu...ACK.sh

debian-9-mipsel

1

recoil.clu...ble.py

windows10-2004-x64

3

recoil.clu...ble.py

windows11-ltsc_2024-x64

3

recoil.clu...ble.py

windows10-2004-x64

3

recoil.clu...ble.py

windows11-ltsc_2024-x64

3

recoil.clu...ble.py

windows10-2004-x64

3

recoil.clu...ble.py

windows11-ltsc_2024-x64

3

recoil.clu...ble.py

windows10-2004-x64

3

recoil.clu...ble.py

windows11-ltsc_2024-x64

3

recoil.clu...ble.py

windows10-2004-x64

3

recoil.clu...ble.py

windows11-ltsc_2024-x64

3

recoil.clu...ing.py

windows10-2004-x64

3

recoil.clu...ing.py

windows11-ltsc_2024-x64

3

recoil.clu...ext.py

windows10-2004-x64

3

recoil.clu...ext.py

windows11-ltsc_2024-x64

3

recoil.clu...ion.py

windows10-2004-x64

3

recoil.clu...ion.py

windows11-ltsc_2024-x64

3

recoil.clu...t__.py

windows10-2004-x64

3

recoil.clu...t__.py

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
recoil.club full leak.7z
Size 147.9MB
Sample261026-3sl11scc43
SHA256 17eb2a0fc25c46155d3bfa12e20e42e63e442cdb00b5ab5d33a64b36bf2d8d5c
MD5 24bba72493e1d8d9aaf7162ad7776a0c
SHA1 7b8dbcaf999e148a9a7af1c7244a0ea58cc854c6
SHA512 e1d57e0f43417c6865f679ab999b534d52133c737cbfa193b3770a116f2ecc9b275ced1cd727dda0c1531d71a36148ed73c678b938f83e7362413784442dbd43
SSDEEP 3145728:DX66myUNr8g6BRKP8foks7JWG4qEKzeme82Ou/PE95a8Sh+ulKRX:myUNrG08fJskGzEKzeme82rHANSnC
TLSH
T1F878339880895C7FED393943B40526E1026F47D673A2D74CAFEB4B32675C6C9C18EA78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution linux

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

recoil.club full leak/RecoilStandalone.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

recoil.club full leak/RecoilStandalone.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

Behavioral task

behavioral3

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/ROLLBACK.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/ROLLBACK.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/ROLLBACK.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/ROLLBACK.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/verify_recovery.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral8

Sample

recoil.club full leak/extracted-source/native-recovered/evidence/verify_recovery.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

recoil.club full leak/extracted-source/native-recovered/notes/recoil-runtime-review.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

recoil.club full leak/extracted-source/native-recovered/notes/recoil-runtime-review.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ROLLBACK.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ROLLBACK.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ROLLBACK.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ROLLBACK.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ai_readable.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral16

Sample

recoil.club full leak/extracted-source/native-recovered/readable/ai_readable.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral17

Sample

recoil.club full leak/extracted-source/native-recovered/readable/menu_readable.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral18

Sample

recoil.club full leak/extracted-source/native-recovered/readable/menu_readable.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral19

Sample

recoil.club full leak/extracted-source/native-recovered/readable/motion_readable.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral20

Sample

recoil.club full leak/extracted-source/native-recovered/readable/motion_readable.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

recoil.club full leak/extracted-source/native-recovered/readable/recoil_readable.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral22

Sample

recoil.club full leak/extracted-source/native-recovered/readable/recoil_readable.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral23

Sample

recoil.club full leak/extracted-source/native-recovered/readable/verify_readable.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

recoil.club full leak/extracted-source/native-recovered/readable/verify_readable.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_mapping.py

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

discovery execution

Behavioral task

behavioral26

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_mapping.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

discovery execution

Behavioral task

behavioral27

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_owned_context.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral28

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_owned_context.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral29

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/cache_session.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral30

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/cache_session.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/deps/capstone/__init__.py

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

recoil.club full leak/extracted-source/python-and-support/analysis/fetch/deps/capstone/__init__.py

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  recoil.club full leak/RecoilStandalone.exe
- Size 93.0MB
- SHA256 291bba2ffc2c7466ca09cc9ecc3fe7747d27f744843e4532df2360a3abf561f5
- MD5 f3b32a025be8ce3929ce0e0c54f56ea9
- SHA1 148061d3aad3dd327048435f41aaed0b0b8891b6
- SHA512 38302a8b2164276f4e271963c7f63763f3c6125a72c45af2eef4c5da9460410fb4b76f965a76d553e5e99558117ce25c54b09852884d0aac73ebc7d1ec6e4591
- SSDEEP 1572864:QpJidEjhnUgahphZdvOGjQpU9Mbt7n2TC4n9dM9HM8nzw/8YsnML5BRu7cyYU0:Q6CjlUgahphZd6Z2T2xzw/8/MyhYU
- TLSH
  T1FF283368C4E5CC2BEC393E3668352991023A5AC6F762C60D6B9F0F36571CBD5C06A63D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  recoil.club full leak/extracted-source/native-recovered/evidence/ROLLBACK.sh
- Size 373B
- SHA256 c553cd6fceb3f458b933c68e30cba98dce54f0dcef6eacef17f4835807072a98
- MD5 77f81f0b651d3c58fe2e06eb4feb9855
- SHA1 52c5e633c997886f6efe83da8c7deb01bfbeccb5
- SHA512 1c5d59200b4028dc15288c74bcd8211d895c8875689f8bdbb72a05aded6225992bd9a573c168e42bbc342c3ed64f5438b5fc23e4b53328bc1d6e5a0f80b5f9b1
- TLSH
  T1E4E0C0D47D0E1B244583866FBA141840EAD081EE0290BC00D2D4BDFFB0BC1E0B083237
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  recoil.club full leak/extracted-source/native-recovered/evidence/verify_recovery.py
- Size 1KB
- SHA256 d524f6ea432e149328e02ed942b0b8d2fe014aefc947399a56ea0c70041b17e1
- MD5 6e508fc26d8934ca5a6801a2de2c4c65
- SHA1 47bd70588c6a3cf19e02dcd7152849d0c6d9aec7
- SHA512 7e4925a5f153512a39fe50196a99293cf394f6041b5cbb230e903315f30d6e48660b306b23e2a89cfd13adfc7ca7c09c689263b616765fecfe04d11bbf468b50
- TLSH
  T1EA21ED61CDB80994139343BF9B2D9A78B724358F30096CA1BAA9F7682F843857933577
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  recoil.club full leak/extracted-source/native-recovered/notes/recoil-runtime-review.txt
- Size 10KB
- SHA256 faeb4b365ae1ca90f6ae1d506658cf30ed0afdafb4ec25b7e2af65072141f4af
- MD5 caad79925ddfe8af7edd57d7aa339dce
- SHA1 1231c2f7a64cec535307943a7045aad19332b161
- SHA512 38adeb6b8b8ea449bfa95a21f6e5712165105b1f8a63cc16b91bc2e37364937bd3ca78967fd3badfff48c471b4a06a17c7da72e615985453287dfb28c78cd28f
- SSDEEP 192:lC1X3jaXXb2eZjRgWVBXIRW9jsrR4m3VKTqawBwh/QUgYGxxvsQNx12/QWqQDfm+:01XT4Xb2ecWvX8SjSL3EONwWjYGxvpLq
- TLSH
  T10F322AC73349337A4F9342A6FA496BF5F75A90282361A8C4F03EA15C111503AC37BE93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/ROLLBACK.sh
- Size 407B
- SHA256 630111e453f6edcebf627ee33f8f61e70744bf64324de631974001be8a8477d6
- MD5 7ec03fc78a1596ec40501172c9601f58
- SHA1 c1ed4eb24a0080c47922bc18dd29e452e6825621
- SHA512 641d1849033fbd97fb73346fd13977575339de010e56beab9d20d340ca2cf9524dd1b31544f20e2217f3737ed0a7cb346e80a9e7db5fd1d562cb449d021ca159
- TLSH
  T168E02BD1790E1B784A63492BB5141D51E6E990AD4190B840E5D8FDDEB1AC6F0B0C3D78
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/ai_readable.py
- Size 5KB
- SHA256 b88188506664166981efef12e88a5d675bfd04e19e720bc25d894bf27f9c1281
- MD5 e2282582b6604e3e345b8ea0fe6626b6
- SHA1 8e243bd2e2efff67ab2472e3f57832bc76a55552
- SHA512 8e3c0be406d84ac9542f24b01949c2347502f7ab0488623d952e61dcd642bc62738eacfefe452d851b3d61682fbac572ad845620475d297e022fbc625a517ac2
- SSDEEP 96:+vDHCNw1DwAbsJw919fpO7pXLmPCis65rMB/HVeAJ4DoU9CL4PFgAt1D5Eiojg1q:+vDHjDwAbsS919fpO7OHssrMBI+WoUF0
- TLSH
  T100C1440BF7B335A58B4B815218537716431381F35B992A30BA6D83481F349A9D2FA7DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/menu_readable.py
- Size 4KB
- SHA256 8d230a289599a69506c220d5c57efe382f4061f6d5c06c31070773257cafb569
- MD5 8a4f98b2ecf62aa29b762736253ef8f7
- SHA1 abdb2037097a3c0fd8370e2d895769f0c6282f4b
- SHA512 29b9d5cdb1b6f8d597fd6382dfad61eed1428faa85bd0e1b1eb11fba90e49f948b00484321593c87a9bfb5ae444efa486e0e538399adbca9212f7dc92c4d3084
- SSDEEP 96:OHzxKn4iDQo0+xs4aO9fTE6ID1j1LCpz3Uy5ItBXDu2keRBURno1LSb0ngqVlX+z:UxWMo0+xshOltILU41l8B87xA7f55S6
- TLSH
  T105A11D0151F017B4364BFA3DE7179E0106053EC3DD1528AAB7AEBB2A1F98B5C617B05B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/motion_readable.py
- Size 2KB
- SHA256 0e1770e82917f6af69153c034031dd83f64b5d21c71b5f0ff8252d4f9f971dea
- MD5 4467de4cf606c44198f5b3a59c093cb1
- SHA1 2e62d5a8cc9a08f7e7ae5a0bb59453fea9b5c7b8
- SHA512 d1fbcf256b12b0c6e52b1104785415f3234e900fa3443ed374598c03baa5336852832ad06b1b72327e583411daf1666d208cf530c70e7a80c20bb648bc53ab47
- TLSH
  T188410209D78025844C17946EDA6E833107D643CB5F0708F8F9AE16447F9422FC9EEAF6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/recoil_readable.py
- Size 5KB
- SHA256 11717297756fb8d255dab50997d1cbfd3516d67ec15b78ce7adc18f0cc60a67b
- MD5 fd40a2f1aeeb82f73ab0fe3e5f8996cd
- SHA1 29a63e78aecd478553897ecdceddbfb131be07fd
- SHA512 77528836c39eb2cba4450237e6a5142d28006b527c1d10b86a7263665eb104882dbfefacbfaecd93be6eb72a96ca30733060e3dcaad4750a861054deb9427214
- SSDEEP 96:v/0+EHfysk7C+YdmJGKms+usYtQfxGccz70i22A7FJFoPGFrB10+UFGbxi0Xpde1:n8Bk7Cgms+5GQfizwi22ABJiPwrB1XUv
- TLSH
  T163C1840BB5D43A6C8E23C55ED19AD6562325A0931FD63C34B87C627C2F1514A43FCDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  recoil.club full leak/extracted-source/native-recovered/readable/verify_readable.py
- Size 11KB
- SHA256 6fd9eb9e2154b53ab5f7a2628f66cb9c96466db5b69782c44e8ece0c2f773550
- MD5 8930eef5d88c8cb09d0b17ec4a3bbdb6
- SHA1 8cd97809ab4925ae5e9dc66083b504d70831d6b5
- SHA512 3814f4e9bc6b92fe20c4d518f8b43cebf5e370bc8e3512c04c33991c0b8f19bbfce0c033212e8f4fac08f187690d9e423700b242cbb69e82b7b509cd2a831965
- SSDEEP 192:aogEkB/B3mkJE92TD1WWWP0EH3vNbQhLWP9Cq89Cxbznlh9sPdMl3/gy6:51kdB3m6iu1zWP0E3vpQhLWPAcbzlhGz
- TLSH
  T10D32A82655A318B4D317C9BED40FE81A076E9857090C2C3AB07E93D93F95294DAEBCF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_mapping.py
- Size 2KB
- SHA256 4a4f59c06a7df2fc4c1b5b746b287974ed1c02840648be21467ee12045a4cffc
- MD5 d511e7ce208659e2c09a01b0874b60ab
- SHA1 1bf5c00eb83125ef1f3a9edce4d3e64813a611e0
- SHA512 ff0ce65f3d7f28b423c5e32859fd803bbc8a71224fada123feac4cd6d26a90d63f23c83b128ab9504424ce22be9ee28a6017973bda23d6f0c23c38d921dce2a5
- TLSH
  T11A51456B4831F9218F53D5E6545FEB03AB1AB583A60C4520F6EC045C3FCA1A652FADF2
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral25 behavioral26
- Target
  recoil.club full leak/extracted-source/python-and-support/analysis/fetch/activating_owned_context.py
- Size 6KB
- SHA256 d5451977ebc118eb76982b9fa8749f45a9f39be609d34c0935b09554782b174a
- MD5 98245dad670898a90ab4ff9b2303a8c0
- SHA1 054fbc40e0edc655aa307d0228423009161b7121
- SHA512 6aca522d186377d7061542c323c2d673c6c10e84814e45a67d45e8b89fe129b31a2638e9bc08e347759c36f2c2655c331d4519e148cd1174a47a88668376f7de
- SSDEEP 96:wl0S7zKVIGkBZ+xg9R/BApHu25qUPIllzF3kv/BPnCA/IrvPZ/JKrvHBWsZ7NcFG:xuGsZcg6pHu25qUCyPofKrBWsZK3g4o3
- TLSH
  T17BD121A689296562E3C7C4765453E6435B5B3883210C5570B8FCCAD83FC42B1C2BADEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  recoil.club full leak/extracted-source/python-and-support/analysis/fetch/cache_session.py
- Size 9KB
- SHA256 45fceb175d705f493786499d2016d2cf34bd8219e02a7e69be1821b21d16c18b
- MD5 dd7ef1d0de508036b91c4fe74e4f04e2
- SHA1 aa922dc0b7015b5324b64ba7f31e94cbf6b28dbd
- SHA512 546e536db1593a58cfe94f21f642246957ac01fbd41f4814f9b63b8f74e9a2b0bd6278d7332be571518810cb49e27c9a97d6d2547e4be74c29ccf734a614e609
- SSDEEP 192:ZF62V8ExzmeoWM479aVOWYsWHfvDegChcO3r9QhTi:7PbPmDyh+
- TLSH
  T1E41283059E48D061C7A3836DAD2791528B24BA935B280D70FC5DD3BA2F48A7DC2B57EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  recoil.club full leak/extracted-source/python-and-support/analysis/fetch/deps/capstone/__init__.py
- Size 42KB
- SHA256 94571d1314355e261aff0ddfc94985fe8761232ddff6874181fd21efa9fab47f
- MD5 175c8c62c9a8873ff2b2468140a1dff7
- SHA1 db6b367adc5641793cf8e76d5e04896ba9df1a28
- SHA512 f0ab0809e96a0c3df5a6aa6877f2b625f9c5bca76bf54ad45ff9f08daff266850fb07d3a58f8013b089dc98067ad65d24f9c568c963c0f4c854426064605b382
- SSDEEP 768:75UMBsSecFkCGIsIfFsheiffBMOAR2akYMIbwG0oiiFWpiaF8EvVLzcJp156zVkd:GGaIsIIxMOl3I
- TLSH
  T1981383200C1BDA496337855A5881E827EF0E670B4978191B3B3CB3B96F74A75C5A0F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

discoveryexecution

behavioral26

discoveryexecution

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy