PoisonIvy

Malware & Tools · PoisonIvy

· MalwareS0012 · Zararlı Yazılım

Type

malware

Techniques

Used By

14 groups

Platforms

Windows

Description

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)

Tactic Coverage

stealth (4)privilege escalation (4)persistence (4)collection (3)command and control (2)discovery (1)credential access (1)execution (1)defense impairment (1)

Used By (14 groups)

G0006APT1Comment Crew, Comment Group G1023APT5Mulberry Typhoon, MANGANESE G0001AxiomGroup 72 G0017DragonOK G0066ElderwoodElderwood Gang, Beijing Group G0093GALLIUMGranite Typhoon G0136IndigoZebra

Techniques (15)

T1005Data from Local System

collection

T1010Application Window Discovery

discovery

T1014Rootkit

stealth

T1027Obfuscated Files or Information

stealth

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

References

https://attack.mitre.org/software/S0012 https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99 https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf https://www.symantec.com/connect/blogs/life-mars-how-attackers-took-advantage-hope-alien-existance-new-darkmoon-campaign