BabyShark
Associated Software Descriptions |
|
| Name | Description |
|---|---|
| LATEOP | (Citation: Mandiant APT43 March 2024) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.(Citation: Unit42 BabyShark Feb 2019)(Citation: CISA AA20-301A Kimsuky) |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
BabyShark has used cmd.exe to execute commands.(Citation: Unit42 BabyShark Feb 2019) |
| Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
BabyShark has encoded data using certutil before exfiltration.(Citation: Unit42 BabyShark Feb 2019) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
BabyShark has cleaned up all files associated with the secondary payload execution.(Citation: Unit42 BabyShark Apr 2019) |
| Enterprise | T1056 | .001 | Input Capture: Keylogging |
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.(Citation: Unit42 BabyShark Apr 2019) |
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
BabyShark has used scheduled tasks to maintain persistence.(Citation: Crowdstrike GTR2020 Mar 2020) |
| Enterprise | T1218 | .005 | System Binary Proxy Execution: Mshta |
BabyShark has used mshta.exe to download and execute applications from a remote server.(Citation: CISA AA20-301A Kimsuky) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0094 | Kimsuky |
(Citation: CISA AA20-301A Kimsuky) (Citation: Crowdstrike GTR2020 Mar 2020) (Citation: Cybereason Kimsuky November 2020) (Citation: Mandiant APT43 March 2024) |
References
- Lim, M.. (2019, April 26). BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat . Retrieved October 7, 2019.
- Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.
- Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
- Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.
- CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.
- Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.