# SoreFang > Tipo: **malware** · S0516 · [MITRE ATT&CK](https://attack.mitre.org/software/S0516) ## Descrição [[s0516-sorefang|SoreFang]] é um downloader de primeiro estágio utilizado pelo [[g0016-apt29|APT29]] para exfiltração de dados e carregamento de outros malwares. **Plataformas:** Windows ## Técnicas Utilizadas - [[t1105-ingress-tool-transfer|T1105 - Ingress Tool Transfer]] - [[t1087-002-domain-account|T1087.002 - Domain Account]] - [[t1057-process-discovery|T1057 - Process Discovery]] - [[t1083-file-and-directory-discovery|T1083 - File and Directory Discovery]] - [[t1071-001-web-protocols|T1071.001 - Web Protocols]] - [[t1190-exploit-public-facing-application|T1190 - Exploit Public-Facing Application]] - [[t1053-005-scheduled-task|T1053.005 - Scheduled Task]] - [[t1082-system-information-discovery|T1082 - System Information Discovery]] - [[t1087-001-local-account|T1087.001 - Local Account]] - [[t1069-002-domain-groups|T1069.002 - Domain Groups]] - [[t1016-system-network-configuration-discovery|T1016 - System Network Configuration Discovery]] - [[t1680-local-storage-discovery|T1680 - Local Storage Discovery]] - [[t1027-obfuscated-files-or-information|T1027 - Obfuscated Files or Information]] - [[t1140-deobfuscatedecode-files-or-information|T1140 - Deobfuscaté/Decode Files or Information]] ## Grupos que Usam - [[g0016-apt29|APT29]] ## Referências - [MITRE ATT&CK - S0516](https://attack.mitre.org/software/S0516)