ECCENTRICBANDWAGON
ECCENTRICBANDWAGON is a remote access Trojan (RAT) used by North Korean cyber actors that was first identified in August 2020. It is a reconnaissance tool--with keylogging and screen capture functionality--used for information gathering on compromised systems.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell |
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.[1] |
| Enterprise | T1113 | 屏幕捕获 |
ECCENTRICBANDWAGON can capture screenshots and store them locally.[1] |
|
| Enterprise | T1074 | .001 | 数据分段: Local Data Staging |
ECCENTRICBANDWAGON has stored keystrokes and screenshots within the |
| Enterprise | T1027 | 混淆文件或信息 |
ECCENTRICBANDWAGON has encrypted strings with RC4.[1] |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
ECCENTRICBANDWAGON can delete log files generated from the malware stored at |
| Enterprise | T1056 | .001 | 输入捕获: Keylogging |
ECCENTRICBANDWAGON can capture and store keystrokes.[1] |