HotCroissant

Malware & Tools · HotCroissant

· MalwareS0431 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

HotCroissant is a remote access trojan (RAT) attributed by U.S. government entities to malicious North Korean government cyber activity, tracked collectively as HIDDEN COBRA.(Citation: US-CERT HOTCROISSANT February 2020) HotCroissant shares numerous code similarities with Rifdoor.(Citation: Carbon Black HotCroissant April 2020)

Tactic Coverage

discovery (8)stealth (4)execution (3)command and control (2)exfiltration (1)persistence (1)privilege escalation (1)collection (1)impact (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (20)

T1007System Service Discovery

discovery

T1010Application Window Discovery

discovery

T1016System Network Configuration Discovery

discovery

T1027.002Software Packing

stealth

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

References

https://attack.mitre.org/software/S0431 https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/https://www.us-cert.gov/ncas/analysis-reports/ar20-045d