Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент KeyBoy
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
KeyBoy
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

KeyBoy

KeyBoy is malware that has been used in targeted campaigns against members of the Tibetan Parliament in 2016.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: PWC KeyBoys Feb 2017)
ID: S0387
Type: MALWARE
Platforms: Windows
Version: 1.2
Created: 14 Jun 2019
Last Modified: 09 Feb 2021

Techniques Used
Domain ID Name Use
Enterprise T1547 .004 Boot or Logon Autostart Execution: Winlogon Helper DLL

KeyBoy issues the command reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” to achieve persistence.(Citation: PWC KeyBoys Feb 2017) (Citation: CitizenLab KeyBoy Nov 2016)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

KeyBoy uses PowerShell commands to download and execute payloads.(Citation: PWC KeyBoys Feb 2017)
.003 Command and Scripting Interpreter: Windows Command Shell

KeyBoy can launch interactive shells for communicating with the victim machine.(Citation: PWC KeyBoys Feb 2017)(Citation: Rapid7 KeyBoy Jun 2013)

.005 Command and Scripting Interpreter: Visual Basic

KeyBoy uses VBS scripts for installing files and performing execution.(Citation: CitizenLab KeyBoy Nov 2016)

.006 Command and Scripting Interpreter: Python

KeyBoy uses Python scripts for installing files and performing execution.(Citation: CitizenLab KeyBoy Nov 2016)

Enterprise T1543 .003 Create or Modify System Process: Windows Service

KeyBoy installs a service pointing to a malicious DLL dropped to disk.(Citation: Rapid7 KeyBoy Jun 2013)
Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

KeyBoy attempts to collect passwords from browsers.(Citation: Rapid7 KeyBoy Jun 2013)
Enterprise T1001 .003 Data Obfuscation: Protocol Impersonation

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.(Citation: PWC KeyBoys Feb 2017)
Enterprise T1564 .003 Hide Artifacts: Hidden Window

KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload. (Citation: PWC KeyBoys Feb 2017)
Enterprise T1070 .006 Indicator Removal: Timestomp

KeyBoy time-stomped its DLL in order to evade detection.(Citation: PWC KeyBoys Feb 2017)
Enterprise T1056 .001 Input Capture: Keylogging

KeyBoy installs a keylogger for intercepting credentials and keystrokes.(Citation: Rapid7 KeyBoy Jun 2013)
Enterprise T1559 .002 Inter-Process Communication: Dynamic Data Exchange

KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.(Citation: PWC KeyBoys Feb 2017)

Groups That Use This Software
ID Name References
G0081 Tropic Trooper

(Citation: Unit 42 Tropic Trooper Nov 2016) (Citation: CitizenLab Tropic Trooper Aug 2018)

References

  1. Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.
  2. Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.
  3. Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.
  4. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  5. Alexander, G., et al. (2018, August 8). Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces. Retrieved June 17, 2019.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.