Amadey
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Amadey has used HTTP for C2 communications.(Citation: BlackBerry Amadey 2020) |
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020) |
| Enterprise | T1568 | .001 | Dynamic Resolution: Fast Flux DNS |
Amadey has used fast flux DNS for its C2.(Citation: Korean FSI TA505 2020) |
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Amadey has checked for a variety of antivirus products.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020) |
| Enterprise | T1553 | .005 | Subvert Trust Controls: Mark-of-the-Web Bypass |
Amadey has modified the `:Zone.Identifier` in the ADS area to zero.(Citation: Korean FSI TA505 2020) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0094 | Kimsuky |
(Citation: Mandiant APT43 March 2024) |
| G0092 | TA505 |
(Citation: Korean FSI TA505 2020) (Citation: BlackBerry Amadey 2020) |
References
- Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
- Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.
- Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.