DEADEYE
Associated Software Descriptions |
|
| Name | Description |
|---|---|
| DEADEYE.EMBED | (Citation: Mandiant APT41) |
| DEADEYE.APPEND | (Citation: Mandiant APT41) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
DEADEYE can run `cmd /c copy /y /b C:\Users\public\syslog_6-*.dat C:\Users\public\syslog.dll` to combine separated sections of code into a single DLL prior to execution.(Citation: Mandiant APT41) |
| Enterprise | T1564 | .004 | Hide Artifacts: NTFS File Attributes |
The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.(Citation: Mandiant APT41) |
| Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.(Citation: Mandiant APT41) |
| Enterprise | T1027 | .009 | Obfuscated Files or Information: Embedded Payloads |
The DEADEYE.EMBED variant of DEADEYE has the ability to embed payloads inside of a compiled binary.(Citation: Mandiant APT41) |
| .013 | Obfuscated Files or Information: Encrypted/Encoded File |
DEADEYE has encrypted its payload.(Citation: Mandiant APT41) |
||
| Enterprise | T1218 | .007 | System Binary Proxy Execution: Msiexec |
DEADEYE can use `msiexec.exe` for execution of malicious DLL.(Citation: Mandiant APT41) |
| .011 | System Binary Proxy Execution: Rundll32 |
DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.(Citation: Mandiant APT41) |
||
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.