Crutch
Description
(ESET) We were able to capture some of the commands sent by the operators to several Crutch v3 instances, which is helpful to understand the goal of the operation. The operators were mainly doing reconnaissance, lateral movement and espionage. The main malicious activity is the staging, compression and exfiltration of documents and various files, as shown in Figure 1. These are commands manually executed by the operators, thus not showing the automated collection of documents by the drive monitor component described in a later section.
Names
| Name |
|---|
| Crutch |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Exfiltration
Information
Mitre Attack
Malpedia
Other Information
Uuid
f1fccfe7-45d8-4a18-ac92-ef5aca3809a7
Last Card Change
2022-12-30