Mispadu

ATP Sandbox Adv. Heuristics

Stats

First seen: May 2023
Last seen: September 2026

MITRE ATT&CK techniques

26 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.005Visual Basic
T1106Native API
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1176Software Extensions
- T1176.001Browser Extensions
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1055Process Injection
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.007Msiexec
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1217Browser Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
- T1056.002GUI Input Capture
T1113Screen Capture
T1115Clipboard Data

TA0011 Command and Control

T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G1026Malteiro

Alert name variants

Alert Name	Engine
Script-WScript.Trojan.Mispadu	ATP Sandbox Adv. Heuristics
Win32.Trojan.Mispadu	ATP Sandbox Adv. Heuristics

Related families

Grandoreiro Metamorfo QakBot DarkGate Empire