HTTPBrowser

Malware & Tools · HTTPBrowser

· MalwareS0070 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

HTTPBrowser is malware that has been used by several threat groups. (Citation: ThreatStream Evasion Analysis) (Citation: Dell TG-3390) It is believed to be of Chinese origin. (Citation: ThreatConnect Anthem)

Tactic Coverage

stealth (4)command and control (3)execution (2)collection (1)credential access (1)discovery (1)persistence (1)privilege escalation (1)

Used By (2 groups)

G0026APT18TG-0416, Dynamite Panda G0027Threat Group-3390Earth Smilodon, TG-3390

Techniques (11)

T1027Obfuscated Files or Information

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1056.001Keylogging

collectioncredential access

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

References

https://attack.mitre.org/software/S0070 https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/