Milan

Malware & Tools · Milan

· MalwareS1015 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Milan is a backdoor implant based on DanBot that was written in Visual C++ and .NET. Milan has been used by HEXANE since at least June 2020.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)

Tactic Coverage

discovery (5)command and control (5)stealth (4)execution (4)collection (2)persistence (1)privilege escalation (1)

Used By (1 groups)

G1001HEXANELyceum, Siamesekitten

Techniques (20)

T1005Data from Local System

collection

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1036Masquerading

stealth

T1036.007Double File Extension

References

https://attack.mitre.org/software/S1015 https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns https://www.clearskysec.com/siamesekitten/https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf