Zebrocy

Malware & Tools · Zebrocy

· MalwareS0251 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Zebrocy is a Trojan that has been used by APT28 since at least November 2015. The malware comes in several programming language variants, including C++, Delphi, AutoIt, C#, VB.NET, and Golang. (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: CISA Zebrocy Oct 2020)

Tactic Coverage

discovery (11)collection (5)command and control (5)stealth (3)persistence (3)privilege escalation (3)execution (3)credential access (2)exfiltration (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (31)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027.002Software Packing

stealth

T1033System Owner/User Discovery

discovery

T1037.001Logon Script (Windows)

persistenceprivilege escalation

T1041Exfiltration Over C2 Channel

exfiltration

References

https://attack.mitre.org/software/S0251 https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/https://www.cyberscoop.com/apt28-brexit-phishing-accenture/

Windows Management Instrumentation

T1049System Network Connections Discovery

discovery

T1053.005Scheduled Task

executionpersistence

T1056.004Credential API Hooking

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1071.003Mail Protocols

command and control

T1074.001Local Data Staging

collection

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1113Screen Capture

collection

T1119Automated Collection

collection

T1120Peripheral Device Discovery

discovery

T1124System Time Discovery

discovery

T1132.001Standard Encoding

command and control

T1135Network Share Discovery

discovery

T1140Deobfuscate/Decode Files or Information

stealth

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1555.003Credentials from Web Browsers

credential access

T1560Archive Collected Data

collection

T1573.002Asymmetric Cryptography

command and control

T1680Local Storage Discovery

discovery