KeyBoy
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1555 | .003 | 从密码存储中获取凭证: Credentials from Web Browsers | |
| Enterprise | T1543 | .003 | 创建或修改系统进程: Windows Service |
KeyBoy installs a service pointing to a malicious DLL dropped to disk.[3] |
| Enterprise | T1547 | .004 | 启动或登录自动启动执行: Winlogon Helper DLL |
KeyBoy issues the command |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
KeyBoy uses PowerShell commands to download and execute payloads.[2] |
| .003 | 命令与脚本解释器: Windows Command Shell |
KeyBoy can launch interactive shells for communicating with the victim machine.[2][3] |
||
| .005 | 命令与脚本解释器: Visual Basic |
KeyBoy uses VBS scripts for installing files and performing execution.[1] |
||
| .006 | 命令与脚本解释器: Python |
KeyBoy uses Python scripts for installing files and performing execution.[1] |
||
| Enterprise | T1113 | 屏幕捕获 | ||
| Enterprise | T1001 | .003 | 数据混淆: Protocol or Service Impersonation |
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.[2] |
| Enterprise | T1083 | 文件和目录发现 |
KeyBoy has a command to launch a file browser or explorer on the system.[2] |
|
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File |
In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.[1] |
| Enterprise | T1070 | .006 | 移除指标: Timestomp | |
| Enterprise | T1082 | 系统信息发现 |
KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.[2][3] |
|
| Enterprise | T1016 | 系统网络配置发现 |
KeyBoy can determine the public or WAN IP address for the system.[2] |
|
| Enterprise | T1105 | 输入工具传输 | ||
| Enterprise | T1056 | .001 | 输入捕获: Keylogging |
KeyBoy installs a keylogger for intercepting credentials and keystrokes.[3] |
| Enterprise | T1559 | .002 | 进程间通信: Dynamic Data Exchange |
KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.[2] |
| Enterprise | T1564 | .003 | 隐藏伪装: Hidden Window |
KeyBoy uses |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0081 | Tropic Trooper |
References
- Hulcoop, A., et al. (2016, November 17). It’s Parliamentary KeyBoy and the targeting of the Tibetan Community. Retrieved June 13, 2019.
- Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.
- Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.