BLACKCOFFEE

Malware & Tools · BLACKCOFFEE

· MalwareS0069 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Windows

Description

BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye APT17) (Citation: FireEye Periscope March 2018)

Tactic Coverage

command and control (3)discovery (2)execution (1)stealth (1)

Used By (3 groups)

G0025APT17Deputy Dog G0096APT41Wicked Panda, Brass Typhoon G0065LeviathanMUDCARP, Kryptonite Panda

Techniques (7)

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1083File and Directory Discovery

discovery

T1102.001Dead Drop Resolver

command and control

T1102.002Bidirectional Communication

command and control

T1104Multi-Stage Channels

References

https://attack.mitre.org/software/S0069 https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html