RDFSNIFFER

Malware & Tools · RDFSNIFFER

· MalwareS0416 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

RDFSNIFFER is a module loaded by BOOSTWRITE which allows an attacker to monitor and tamper with legitimate connections made via an application designed to provide visibility and system management capabilities to remote IT techs.(Citation: FireEye FIN7 Oct 2019)

Tactic Coverage

collection (1)credential access (1)stealth (1)execution (1)

Used By (1 groups)

G0046FIN7GOLD NIAGARA, ITG14

Techniques (3)

T1056.004Credential API Hooking

collectioncredential access

T1070.004File Deletion

stealth

T1106Native API

execution

References

https://attack.mitre.org/software/S0416 https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html