Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
 
Вход Регистрация
MITRE ATT&CK - Преступная группа Evilnum
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Evilnum
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Evilnum

Evilnum is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)
ID: G0120
Associated Groups: 
Version: 1.0
Created: 22 Jan 2021
Last Modified: 27 Apr 2021

Associated Group Descriptions
Name Description

Techniques Used
Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

Evilnum has used PowerShell to bypass UAC.(Citation: ESET EvilNum July 2020)
Enterprise T1059 .007 Command and Scripting Interpreter: JavaScript

Evilnum has used malicious JavaScript files on the victim's machine.(Citation: ESET EvilNum July 2020)
Enterprise T1574 .001 Hijack Execution Flow: DLL Search Order Hijacking

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.(Citation: ESET EvilNum July 2020)

Enterprise T1070 .004 Indicator Removal: File Deletion

Evilnum has deleted files used during infection.(Citation: ESET EvilNum July 2020)
Enterprise T1566 .002 Phishing: Spearphishing Link

Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.(Citation: ESET EvilNum July 2020)
Enterprise T1204 .001 User Execution: Malicious Link

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.(Citation: ESET EvilNum July 2020)
Enterprise T1497 .001 Virtualization/Sandbox Evasion: System Checks

Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments. (Citation: ESET EvilNum July 2020)

Software
ID Name References Techniques
S0568 EVILNUM (Citation: ESET EvilNum July 2020) (Citation: Prevailion EvilNum May 2020) One-Way Communication, Registry Run Keys / Startup Folder, Indicator Removal, System Information Discovery, Exfiltration Over C2 Channel, Steal Web Session Cookie, Timestomp, Modify Registry, Ingress Tool Transfer, System Owner/User Discovery, Rundll32, Security Software Discovery, Regsvr32, Windows Management Instrumentation
S0349 LaZagne (Citation: ESET EvilNum July 2020) (Citation: GitHub LaZagne Dec 2018) (Citation: GitHub LaZange Dec 2018) Credentials In Files, Windows Credential Manager, LSA Secrets, /etc/passwd and /etc/shadow, Credentials from Web Browsers, LSASS Memory, Cached Domain Credentials, Credentials from Password Stores, Keychain, Proc Filesystem
S0284 More_eggs (Citation: Crowdstrike GTR2020 Mar 2020) (Citation: ESET EvilNum July 2020) (Citation: Security Intelligence More Eggs Aug 2019) (Citation: SKID) (Citation: SpicyOmelette) (Citation: Talos Cobalt Group July 2018) (Citation: Terra Loader) (Citation: Visa FIN6 Feb 2019) Ingress Tool Transfer, Internet Connection Discovery, Deobfuscate/Decode Files or Information, System Information Discovery, Web Protocols, Symmetric Cryptography, Windows Command Shell, Encrypted/Encoded File, File Deletion, System Network Configuration Discovery, Standard Encoding, Security Software Discovery, Code Signing, Regsvr32, System Owner/User Discovery

References

  1. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
  2. Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved December 22, 2021.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.