OwaAuth — Malware Profile

OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390.

MITRE ATT&CK techniques (8)

• T1036.005 Match Legitimate Resource Name or Location
• T1056.001 Keylogging
• T1070.006 Timestomp
• T1071.001 Web Protocols
• T1083 File and Directory Discovery
• T1505.003 Web Shell
• T1505.004 IIS Components
• T1560.003 Archive via Custom Method

Read the full analysis on IntelFusions