Matryoshka

Matryoshka is a malware framework used by CopyKittens that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences.

View graph Watch Export

Indicators tracked

Intelligence Reports20

20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

24 relationships

T1053.005: Scheduled Task

source

T1113: Screen Capture

source

T1218.011: Rundll32

source

T1056.001: Keylogging

source

T1071.004: DNS

source

T1555: Credentials from Password Stores

source

T1059: Command and Scripting Interpreter

source

T1547.001: Registry Run Keys / Startup Folder

source

T1027: Obfuscated Files or Information

source

T1055.001: Dynamic-link Library Injection

source