Daserf
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol:Web Protocols | |
| Enterprise | T1560 | Archive Collected Data | Daserf hides collected data in password-protected .rar archives.[3] | |
| .001 | Archive via Utility | Daserf hides collected data in password-protected .rar archives.[3] | ||
| Enterprise | T1059 | .003 | Command and Scripting Interpreter:Windows Command Shell | |
| Enterprise | T1132 | .001 | Data Encoding:Standard Encoding | Daserf uses custom base64 encoding to obfuscate HTTP traffic.[2] |
| Enterprise | T1001 | .002 | Data Obfuscation:Steganography | Daserf can use steganography to hide malicious code downloaded to the victim.[1] |
| Enterprise | T1573 | .001 | Encrypted Channel:Symmetric Cryptography | |
| Enterprise | T1105 | Ingress Tool Transfer | ||
| Enterprise | T1056 | .001 | Input Capture:Keylogging | |
| Enterprise | T1036 | .005 | Masquerading:Match Legitimate Resource Name or Location | Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.[3] |
| Enterprise | T1027 | Obfuscated Files or Information | Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.[1] | |
| .002 | Software Packing | |||
| .005 | Indicator Removal from Tools | Analysis ofDaserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.[1] | ||
| Enterprise | T1003 | .001 | OS Credential Dumping:LSASS Memory | Daserf leveragesMimikatz andWindows Credential Editor to steal credentials.[3] |
| Enterprise | T1113 | Screen Capture | ||
| Enterprise | T1553 | .002 | Subvert Trust Controls:Code Signing | SomeDaserf samples were signed with a stolen digital certificate.[3] |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0060 | BRONZE BUTLER |