EVILNUM

Malware & Tools · EVILNUM

· MalwareS0568 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

EVILNUM is fully capable backdoor that was first identified in 2018. EVILNUM is used by the APT group Evilnum which has the same name.(Citation: ESET EvilNum July 2020)(Citation: Prevailion EvilNum May 2020)

Tactic Coverage

stealth (4)discovery (3)command and control (2)persistence (2)exfiltration (1)execution (1)defense impairment (1)credential access (1)privilege escalation (1)

Used By (1 groups)

G0120Evilnum

Techniques (14)

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1047Windows Management Instrumentation

execution

T1070Indicator Removal

stealth

T1070.006Timestomp

stealth

T1082System Information Discovery

discovery

T1102.003One-Way Communication

References

https://attack.mitre.org/software/S0568 https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/