Gomir
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Gomir periodically communicates to its command and control infrastructure through HTTP POST requests.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1059 | .004 | Command and Scripting Interpreter: Unix Shell |
Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1543 | .002 | Create or Modify System Process: Systemd Service |
Gomir creates a systemd service named `syslogd` for persistence.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
Gomir uses reverse proxy functionality that employs SSL to encrypt communications.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
Gomir deletes its original executable and terminates its original process after creating a systemd service.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1069 | .001 | Permission Groups Discovery: Local Groups |
Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1090 | .001 | Proxy: Internal Proxy |
Gomir can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.(Citation: Symantec Troll Stealer 2024) |
| Enterprise | T1053 | .003 | Scheduled Task/Job: Cron |
Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.(Citation: Symantec Troll Stealer 2024) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.