JSS Loader

Malware & Tools · JSS Loader

· MalwareS0648 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

JSS Loader is Remote Access Trojan (RAT) with .NET and C++ variants that has been used by FIN7 since at least 2020.(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)

Tactic Coverage

execution (5)persistence (1)privilege escalation (1)command and control (1)initial access (1)

Used By (1 groups)

G0046FIN7GOLD NIAGARA, ITG14

Techniques (7)

T1053.005Scheduled Task

executionpersistence

T1059.001PowerShell

execution

T1059.005Visual Basic

execution

T1059.007JavaScript

execution

T1105Ingress Tool Transfer

command and control

T1204.002Malicious File

execution

T1566.001

References

https://attack.mitre.org/software/S0648 https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/