BitPaymer

Malware & Tools · BitPaymer

· MalwareS0570 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. BitPaymer uses a unique encryption key, ransom note, and contact information for each operation. BitPaymer has several indicators suggesting overlap with the Dridex malware and is often delivered via Dridex.(Citation: Crowdstrike Indrik November 2018)

Tactic Coverage

discovery (5)stealth (5)privilege escalation (4)persistence (3)defense impairment (2)impact (2)execution (1)

Used By (1 groups)

G0119Indrik SpiderEvil Corp, Manatee Tempest

Techniques (18)

T1007System Service Discovery

discovery

T1012Query Registry

discovery

T1018Remote System Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1070.006Timestomp

stealth

T1087.001Local Account

discovery

T1106Native API

References

https://attack.mitre.org/software/S0570 https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/