ADVSTORESHELL

Malware & Tools · ADVSTORESHELL

· MalwareS0045 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)

Tactic Coverage

discovery (5)collection (4)command and control (4)stealth (3)persistence (3)exfiltration (2)execution (2)privilege escalation (2)credential access (1)defense impairment (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (23)

T1012Query Registry

discovery

T1027Obfuscated Files or Information

stealth

T1029Scheduled Transfer

exfiltration

T1041Exfiltration Over C2 Channel

exfiltration

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0045 https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf