DUSTPAN

Malware & Tools · DUSTPAN

· MalwareS1158 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

DUSTPAN is an in-memory dropper written in C/C++ used by APT41 since 2021 that decrypts and executes an embedded payload.(Citation: Google Cloud APT41 2024)(Citation: Google Cloud APT41 2022)

Tactic Coverage

stealth (5)privilege escalation (2)persistence (1)

Used By (1 groups)

G0096APT41Wicked Panda, Brass Typhoon

Techniques (6)

T1027.009Embedded Payloads

stealth

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1055.002Portable Executable Injection

stealthprivilege escalation

T1140Deobfuscate/Decode Files or Information

stealth

T1543.003Windows Service

persistenceprivilege escalation

References

https://attack.mitre.org/software/S1158 https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments