T1003 OS Credential Dumping in real malware

ATT&CK technique T1003 OS Credential Dumping appears in 317 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.3% of the analyzed corpus. Seven-day prevalence is falling (0 recent vs 3 prior). Most associated families: Beebone, HUILoader, RedLine.

Tactics: credential-access

Prevalence in the corpus

Malware families using T1003

Example samples

Canonical technique definition: MITRE ATT&CK T1003 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1003

How common is ATT&CK T1003 (OS Credential Dumping) in real malware?
ATT&CK technique T1003 OS Credential Dumping appears in 317 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.3% of the analyzed corpus. Seven-day prevalence is falling (0 recent vs 3 prior). Most associated families: Beebone, HUILoader, RedLine.
Is T1003 becoming more common?
Prevalence is falling: 0 samples in the last seven days against 3 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
Which malware families use T1003?
In this corpus T1003 is most associated with Beebone (96), HUILoader (26), RedLine (8). Counts are analyzed samples per family in which the technique was observed.
What share of analyzed samples use T1003?
0.3% of the publicly analyzed corpus (317 of 114611 samples) exhibits T1003. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats