Bisonal

Malware & Tools · Bisonal

· MalwareS0268 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Bisonal is a remote access tool (RAT) that has been used by Tonto Team against public and private sector organizations in Russia, South Korea, and Japan since at least December 2010.(Citation: Unit 42 Bisonal July 2018)(Citation: Talos Bisonal Mar 2020)

Tactic Coverage

stealth (10)discovery (8)command and control (7)execution (4)persistence (4)privilege escalation (2)collection (1)exfiltration (1)defense impairment (1)initial access (1)

Used By (1 groups)

G0131Tonto TeamEarth Akhlut, BRONZE HUNTLEY

Techniques (34)

T1005Data from Local System

collection

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027.001Binary Padding

stealth

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1036Masquerading

References

https://attack.mitre.org/software/S0268 https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1059.005Visual Basic

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090Proxy

command and control

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1124System Time Discovery

discovery

T1132.001Standard Encoding

command and control

T1137.006Add-ins

persistence

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

T1218.011Rundll32

stealth

T1497Virtualization/Sandbox Evasion

stealthdiscovery

T1497.003Time Based Checks

stealthdiscovery

T1543.003Windows Service

persistenceprivilege escalation

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1566.001Spearphishing Attachment

initial access

T1568Dynamic Resolution

command and control

T1573.001Symmetric Cryptography

command and control