HOPLIGHT

Malware & Tools · HOPLIGHT

· MalwareS0376 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

HOPLIGHT is a backdoor Trojan that has reportedly been used by the North Korean government.(Citation: US-CERT HOPLIGHT Apr 2019)

Tactic Coverage

discovery (6)command and control (5)execution (3)privilege escalation (2)defense impairment (2)persistence (2)credential access (1)exfiltration (1)stealth (1)lateral movement (1)

Used By (2 groups)

G0082APT38NICKEL GLADSTONE, BeagleBoyz G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (21)

T1003.002Security Account Manager

credential access

T1008Fallback Channels

command and control

T1012Query Registry

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1047Windows Management Instrumentation

execution

T1055Process Injection

stealthprivilege escalation

References

https://attack.mitre.org/software/S0376 https://www.us-cert.gov/ncas/analysis-reports/AR19-100A

Windows Command Shell

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090Proxy

command and control

T1105Ingress Tool Transfer

command and control

T1112Modify Registry

defense impairmentpersistence

T1124System Time Discovery

discovery

T1132.001Standard Encoding

command and control

T1546.003Windows Management Instrumentation Event Subscription

privilege escalationpersistence

T1550.002Pass the Hash

lateral movement

T1569.002Service Execution

execution

T1571Non-Standard Port

command and control

T1652Device Driver Discovery

discovery

T1680Local Storage Discovery

discovery

T1686Disable or Modify System Firewall

defense impairment