BoxCaon

Malware & Tools · BoxCaon

· MalwareS0651 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

BoxCaon is a Windows backdoor that was used by IndigoZebra in a 2021 spearphishing campaign against Afghan government officials. BoxCaon's name stems from similarities shared with the malware family xCaon.(Citation: Checkpoint IndigoZebra July 2021)

Tactic Coverage

collection (2)discovery (2)exfiltration (2)execution (2)command and control (2)stealth (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0136IndigoZebra

Techniques (12)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1059.003Windows Command Shell

execution

T1074.001Local Data Staging

collection

T1083File and Directory Discovery

References

https://attack.mitre.org/software/S0651 https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html