KOCTOPUS

Malware & Tools · KOCTOPUS

· MalwareS0669 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

KOCTOPUS's batch variant is loader used by LazyScripter since 2018 to launch Octopus and Koadic and, in some cases, QuasarRAT. KOCTOPUS also has a VBA variant that has the same functionality as the batch version.(Citation: MalwareBytes LazyScripter Feb 2021)

Tactic Coverage

execution (6)stealth (5)command and control (2)defense impairment (2)persistence (2)privilege escalation (2)initial access (2)discovery (1)

Used By (1 groups)

G0140LazyScripter

Techniques (20)

T1027.010Command Obfuscation

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1059.005Visual Basic

execution

T1070.009Clear Persistence

stealth

T1082System Information Discovery

References

https://attack.mitre.org/software/S0669 https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf