Felismus
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Felismus uses HTTP for C2.(Citation: Forcepoint Felismus Mar 2017) |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Felismus uses command line for execution.(Citation: Forcepoint Felismus Mar 2017) |
| Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.(Citation: Forcepoint Felismus Mar 2017) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.(Citation: Forcepoint Felismus Mar 2017) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
Felismus has masqueraded as legitimate Adobe Content Management System files.(Citation: ATT Felismus) |
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Felismus checks for processes associated with anti-virus vendors.(Citation: Forcepoint Felismus Mar 2017) |
References
- Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.
- Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.
- Julia Kisielius. (2017, April 25). The Felismus RAT: Powerful Threat, Mysterious Purpose. Retrieved January 10, 2024.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.