Search/Mafalda
● Malware

Mafalda

Mafalda is a flexible interactive implant that has been used by Metador. Security researchers assess the Mafalda name may be inspired by an Argentinian cartoon character that has been popular as a means of political commentary since the 1960s.

View graph Watch Export
Indicators tracked
0
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
37 relationships
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1132.001: Standard Encoding
source
T1027.013: Encrypted/Encoded File
source
T1133: External Remote Services
source
T1074.001: Local Data Staging
source
T1573.001: Symmetric Cryptography
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1112: Modify Registry
source
T1217: Browser Information Discovery
source
T1552.004: Private Keys
source
T1003.001: LSASS Memory
source
T1016: System Network Configuration Discovery
source
T1685.005: Clear Windows Event Logs
source
T1083: File and Directory Discovery
source
T1049: System Network Connections Discovery
source
T1205.001: Port Knocking
source
T1134.003: Make and Impersonate Token
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1059.001: PowerShell
source
T1056: Input Capture
source
T1095: Non-Application Layer Protocol
source
T1012: Query Registry
source
T1518.001: Security Software Discovery
source
T1059.003: Windows Command Shell
source
T1134: Access Token Manipulation
source
T1071.001: Web Protocols
source
T1622: Debugger Evasion
source
T1105: Ingress Tool Transfer
source
T1569.002: Service Execution
source
T1680: Local Storage Discovery
source
T1090.001: Internal Proxy
source