Command and Scripting Interpreter: Visual Basic – T1059.005 User Execution: Malicious Link – T1204.001 User Execution: Malicious File – T1204.002 Persistence, Privilege Escalation  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - T1547.001  Discovery  Account Discovery: Domain Account - T1087.002  Credential Access  Credentials from Password Stores: Credentials from Web Browsers – T1555.003  Command and Control  Data Encoding: Standard Encoding – T1132.001  Defense Evasion  Deobfuscate/Decode Files or Information - T1140   Indicators of Compromise Files  File name SHA-256 Trend Micro Detection Name Description SharpChisel.exe 61f83466b512eb12fc82441259a5205f076254546a7726a2e3e983011898e4e2 HackTool.MSIL.Chisel.A SharpChisel tunneling tool PD64.dll ccdddd1ebf3c5de2e68b4dcb8fbc7d4ed32e8f39f6fdf71ac022a7b4d0aa4131 Trojan.Win64.PASSDUMP.A File used by HackTool.Win64.PassDump.AC PasswordDumper.exe 0cd6f593cc58ba3ac40f9803d97a6162a308ec3caa53e1ea1ce7f977f2e667d3 HackTool.Win64.PassDump.AC