Kerrdown

Malware & Tools · Kerrdown

· MalwareS0585 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Kerrdown is a custom downloader that has been used by APT32 since at least 2018 to install spyware from a server on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Unit 42 KerrDown February 2019)

Tactic Coverage

stealth (4)execution (4)initial access (2)discovery (1)command and control (1)

Used By (1 groups)

G0050APT32SeaLotus, OceanLotus

Techniques (11)

T1027.013Encrypted/Encoded File

stealth

T1027.015Compression

stealth

T1059.005Visual Basic

execution

T1082System Information Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1140Deobfuscate/Decode Files or Information

stealth

T1204.001Malicious Link

References

https://attack.mitre.org/software/S0585 https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/