Elise

Malware & Tools · Elise

· MalwareS0081 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Elise is a custom backdoor Trojan that appears to be used exclusively by Lotus Blossom. It is part of a larger group of tools referred to as LStudio, ST Group, and APT0LSTU.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)

Tactic Coverage

discovery (6)stealth (6)command and control (4)privilege escalation (3)persistence (2)collection (1)

Used By (1 groups)

G0030Lotus BlossomDRAGONFISH, Spring Dragon

Techniques (19)

T1007System Service Discovery

discovery

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0081 https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html