Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. Hannotog

Hannotog

Hannotog is a type of backdoor malware uniquely assoicated withLotus Blossom operations since at least 2022.[1]

ID: S1211
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 16 March 2025
Last Modified: 04 April 2025
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1020Automated Exfiltration

Hannotog can upload encyrpted data for exfiltration.[1]

EnterpriseT1059.003Command and Scripting Interpreter:Windows Command Shell

Hannotog can execute variouscmd.exe /c %s commands.[1]

EnterpriseT1543.003Create or Modify System Process:Windows Service

Hannotog creates a new service for persistence.[1]

EnterpriseT1562.004Impair Defenses:Disable or Modify System Firewall

Hannotog can modify local firewall settings vianetsh commands to open a listening UDP port.[1]

EnterpriseT1105Ingress Tool Transfer

Hannotog can download additional files to the victim machine.[1]

EnterpriseT1571Non-Standard Port

Hannotog uses non-standard listening ports, such as UDP 5900, for command and control purposes.[1]

EnterpriseT1489Service Stop

Hannotog can stop Windows services.[1]

Groups That Use This Software

IDNameReferences
G0030Lotus Blossom

Hannotog is a backdoor associated withLotus Blossom operations.[1]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp