Bankshot

Malware & Tools · Bankshot

· MalwareS0239 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector. (Citation: McAfee Bankshot)

Tactic Coverage

discovery (7)command and control (5)stealth (5)execution (3)collection (2)persistence (2)privilege escalation (2)exfiltration (1)defense impairment (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (25)

T1001.003Protocol or Service Impersonation

command and control

T1005Data from Local System

collection

T1012Query Registry

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070Indicator Removal

References

https://attack.mitre.org/software/S0239 https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/

T1070.004File Deletion

stealth

T1070.006Timestomp

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1087.001Local Account

discovery

T1087.002Domain Account

discovery

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1119Automated Collection

collection

T1132.002Non-Standard Encoding

command and control

T1134.002Create Process with Token

stealthprivilege escalation

T1140Deobfuscate/Decode Files or Information

stealth

T1203Exploitation for Client Execution

execution

T1543.003Windows Service

persistenceprivilege escalation

T1571Non-Standard Port

command and control

T1680Local Storage Discovery

discovery