Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент Javali
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
Javali
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Javali

Javali is a banking trojan that has targeted Portuguese and Spanish-speaking countries since 2017, primarily focusing on customers of financial institutions in Brazil and Mexico.(Citation: Securelist Brazilian Banking Malware July 2020)
ID: S0528
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 09 Nov 2020
Last Modified: 22 Dec 2020

Techniques Used
Domain ID Name Use
Enterprise T1059 .005 Command and Scripting Interpreter: Visual Basic

Javali has used embedded VBScript to download malicious payloads from C2.(Citation: Securelist Brazilian Banking Malware July 2020)
Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.(Citation: Securelist Brazilian Banking Malware July 2020)
Enterprise T1574 .002 Hijack Execution Flow: DLL Side-Loading

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.(Citation: Securelist Brazilian Banking Malware July 2020)
Enterprise T1027 .001 Obfuscated Files or Information: Binary Padding

Javali can use large obfuscated libraries to hinder detection and analysis.(Citation: Securelist Brazilian Banking Malware July 2020)
Enterprise T1566 .001 Phishing: Spearphishing Attachment

Javali has been delivered as malicious e-mail attachments.(Citation: Securelist Brazilian Banking Malware July 2020)
.002 Phishing: Spearphishing Link

Javali has been delivered via malicious links embedded in e-mails.(Citation: Securelist Brazilian Banking Malware July 2020)

Enterprise T1218 .007 System Binary Proxy Execution: Msiexec

Javali has used the MSI installer to download and execute malicious payloads.(Citation: Securelist Brazilian Banking Malware July 2020)
Enterprise T1204 .001 User Execution: Malicious Link

Javali has achieved execution through victims clicking links to malicious websites.(Citation: Securelist Brazilian Banking Malware July 2020)
.002 User Execution: Malicious File

Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.(Citation: Securelist Brazilian Banking Malware July 2020)

Enterprise T1102 .001 Web Service: Dead Drop Resolver

Javali can read C2 information from Google Documents and YouTube.(Citation: Securelist Brazilian Banking Malware July 2020)

References

  1. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.