SoreFang

Malware & Tools · SoreFang

· MalwareS0516 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

SoreFang is first stage downloader used by APT29 for exfiltration and to load other malware.(Citation: NCSC APT29 July 2020)(Citation: CISA SoreFang July 2016)

Tactic Coverage

discovery (8)stealth (2)command and control (2)execution (1)persistence (1)privilege escalation (1)initial access (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (14)

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1053.005Scheduled Task

executionpersistence

T1057Process Discovery

discovery

T1069.002Domain Groups

discovery

T1071.001Web Protocols

command and control

References

https://attack.mitre.org/software/S0516 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf