FALLCHILL

Malware & Tools · FALLCHILL

· MalwareS0181 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

FALLCHILL is a RAT that has been used by Lazarus Group since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other Lazarus Group malware or delivered when a victim unknowingly visits a compromised website. (Citation: US-CERT FALLCHILL Nov 2017)

Tactic Coverage

discovery (4)command and control (2)stealth (2)persistence (1)privilege escalation (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (9)

T1001.003Protocol or Service Impersonation

command and control

T1016System Network Configuration Discovery

discovery

T1070.004File Deletion

stealth

T1070.006Timestomp

stealth

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1543.003Windows Service

References

https://attack.mitre.org/software/S0181 https://www.us-cert.gov/ncas/alerts/TA17-318A