BOOKWORM

Malware & Tools · BOOKWORM

· MalwareS1226 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

BOOKWORM is a modular trojan known to be leveraged by Mustang Panda and was first observed utilized in 2015. BOOKWORM was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters. (Citation: Broadcom)(Citation: Unit42 Bookworm Nov2015)(Citation: Palo Alto Networks, Unit 42)

Tactic Coverage

stealth (7)command and control (3)collection (2)execution (2)defense impairment (2)persistence (2)discovery (1)credential access (1)privilege escalation (1)

Used By (1 groups)

G0129Mustang PandaTA416, RedDelta

Techniques (17)

T1001.003Protocol or Service Impersonation

command and control

T1027Obfuscated Files or Information

stealth

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1036.004Masquerade Task or Service

stealth

T1056.001Keylogging

collectioncredential access

References

https://attack.mitre.org/software/S1226 https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/