DustySky

Malware & Tools · DustySky

· MalwareS0062 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

DustySky is multi-stage malware written in .NET that has been used by Molerats since May 2015. (Citation: DustySky) (Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)

Tactic Coverage

discovery (6)collection (4)command and control (2)stealth (2)lateral movement (2)exfiltration (1)execution (1)credential access (1)initial access (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0021MoleratsOperation Molerats, Gaza Cybergang

Techniques (19)

T1008Fallback Channels

command and control

T1027Obfuscated Files or Information

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1047Windows Management Instrumentation

execution

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0062 https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/