GreyEnergy

Malware & Tools · GreyEnergy

· MalwareS0342 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

GreyEnergy is a backdoor written in C and compiled in Visual Studio. GreyEnergy shares similarities with the BlackEnergy malware and is thought to be the successor of it.(Citation: ESET GreyEnergy Oct 2018)

Tactic Coverage

stealth (5)command and control (5)credential access (2)privilege escalation (2)defense impairment (2)persistence (2)discovery (1)collection (1)execution (1)

Used By (1 groups)

G0034Sandworm TeamELECTRUM, Telebots

Techniques (17)

T1003.001LSASS Memory

credential access

T1007System Service Discovery

discovery

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1055.002Portable Executable Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

References

https://attack.mitre.org/software/S0342 https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf