Pasam
ID: S0208
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 18 April 2018
Last Modified: 21 October 2025
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .008 | Boot or Logon Autostart Execution:LSASS Driver | Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.[2] |
| Enterprise | T1005 | Data from Local System | Pasam creates a backdoor through which remote attackers can retrieve files.[2] | |
| Enterprise | T1083 | File and Directory Discovery | Pasam creates a backdoor through which remote attackers can retrieve lists of files.[2] | |
| Enterprise | T1070 | .004 | Indicator Removal:File Deletion | Pasam creates a backdoor through which remote attackers can delete files.[2] |
| Enterprise | T1105 | Ingress Tool Transfer | Pasam creates a backdoor through which remote attackers can upload files.[2] | |
| Enterprise | T1680 | Local Storage Discovery | Pasam creates a backdoor through which remote attackers can retrieve information like free disk space.[2] | |
| Enterprise | T1057 | Process Discovery | Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.[2] | |
| Enterprise | T1082 | System Information Discovery | Pasam creates a backdoor through which remote attackers can retrieve information like hostname.[2] | |
Groups That Use This Software
References
×