Kazuar

Malware & Tools · Kazuar

· MalwareS0265 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows, macOS

Description

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. (Citation: Unit 42 Kazuar May 2017)

Tactic Coverage

discovery (9)command and control (7)collection (4)privilege escalation (4)stealth (3)execution (3)persistence (3)exfiltration (1)impact (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (31)

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1010Application Window Discovery

discovery

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1029Scheduled Transfer

exfiltration

T1033System Owner/User Discovery

References

https://attack.mitre.org/software/S0265 https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/

T1047Windows Management Instrumentation

execution

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1059.004Unix Shell

execution

T1069.001Local Groups

discovery

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1071.002File Transfer Protocols

command and control

T1074.001Local Data Staging

collection

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1087.001Local Account

discovery

T1090.001Internal Proxy

command and control

T1102.002Bidirectional Communication

command and control

T1105Ingress Tool Transfer

command and control

T1113Screen Capture

collection

T1125Video Capture

collection

T1132.001Standard Encoding

command and control

T1485Data Destruction

impact

T1543.003Windows Service

persistenceprivilege escalation

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1547.009Shortcut Modification

persistenceprivilege escalation

T1680Local Storage Discovery

discovery