CozyCar

ATP Sandbox Adv. Heuristics

Description

CozyCar is a modular malware platform that APT29 used from 2010 to 2015, whose backdoor component could download and execute a variety of modules with different functionality.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

CozerCozyBearCozyDuke

MITRE ATT&CK techniques

14 techniques across 6 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.003Rename Legitimate Utilities
T1218System Binary Proxy Execution
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory
- T1003.002Security Account Manager

TA0007 Discovery

T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.002Bidirectional Communication

Associated groups

G0016APT29

Alert name variants

Alert Name	Engine
Document-Office.Downloader.Cozer	ATP Sandbox Adv. Heuristics
Script-Macro.Downloader.Cozer	ATP Sandbox Adv. Heuristics
Script-Python.Trojan.Cozer	ATP Sandbox Adv. Heuristics
Win32.Trojan.Cozer	ATP Sandbox Adv. Heuristics
Win32.Trojan.CozyBear	ATP Sandbox Adv. Heuristics
Win32.Trojan.CozyCar	ATP Sandbox Adv. Heuristics
Win32.Trojan.CozyDuke	ATP Sandbox Adv. Heuristics
Win64.Trojan.Cozer	ATP Sandbox Adv. Heuristics

Related families

Empire Bazar IcedID Latrodectus QakBot

References