TAINTEDSCRIBE

Malware & Tools · TAINTEDSCRIBE

· MalwareS0586 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

TAINTEDSCRIBE is a fully-featured beaconing implant integrated with command modules used by Lazarus Group. It was first reported in May 2020.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)

Tactic Coverage

discovery (5)command and control (4)stealth (4)execution (1)persistence (1)privilege escalation (1)collection (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (16)

T1001.003Protocol or Service Impersonation

command and control

T1008Fallback Channels

command and control

T1018Remote System Discovery

discovery

T1027.001Binary Padding

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1057Process Discovery

discovery

T1059.003

References

https://attack.mitre.org/software/S0586 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b