Anomali Cyber Watch: Ransomware Module Added to SOVA Android Trojan, Bitter APT Targets Mobile Phones with Dracarys, China-Sponsored TA428 Deploys Six Backdoors at Once, and More
Tags
cmtmf-attack-pattern: Application Layer Protocol Boot Or Logon Autostart Execution Command And Scripting Interpreter Masquerading Obfuscated Files Or Information Process Injection
country: Afghanistan Belarus China Cuba North Korea Germany India Pakistan Italy Spain Philippines Ukraine United Kingdom
maec-delivery-vectors: Watering Hole
attack-pattern: Data Application Layer Protocol - T1437 Archive Collected Data - T1560 Archive Collected Data - T1532 Audio Capture - T1429 Boot Or Logon Autostart Execution - T1547 Command And Scripting Interpreter - T1623 Credentials - T1589.001 Credentials From Password Stores - T1555 Data Encrypted For Impact - T1471 Data Encrypted For Impact - T1486 Data From Local System - T1533 Exploitation For Privilege Escalation - T1404 Exploitation For Client Execution - T1658 File And Directory Discovery - T1420 Hijack Execution Flow - T1625 Hijack Execution Flow - T1574 Impair Defenses - T1562 Impair Defenses - T1629 Indicator Removal On Host - T1630 Ingress Tool Transfer - T1544 Input Capture - T1417 Lsass Memory - T1003.001 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Obfuscated Files Or Information - T1406 Process Discovery - T1424 System Information Discovery - T1426 Native Api - T1575 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Process Injection - T1631 Scheduled Task - T1053.005 Screen Capture - T1513 Server - T1583.004 Server - T1584.004 Software - T1592.002 Spearphishing Attachment - T1566.001 Spearphishing Attachment - T1598.002 Steal Or Forge Kerberos Tickets - T1558 Vnc - T1021.005 Template Injection - T1221 Virtualization/Sandbox Evasion - T1497 Unsecured Credentials - T1552 Tool - T1588.002 Vulnerabilities - T1588.006 Virtualization/Sandbox Evasion - T1633 Standard Application Layer Protocol - T1071 Audio Capture - T1123 Command-Line Interface - T1059 Connection Proxy - T1090 Credential Dumping - T1003 Data From Local System - T1005 Data From Network Shared Drive - T1039 Data From Removable Media - T1025 Data Staged - T1074 Deobfuscate/Decode Files Or Information - T1140 Execution Through Api - T1106 Exploitation For Client Execution - T1203 Exploitation For Privilege Escalation - T1068 File And Directory Discovery - T1083 Indicator Removal On Host - T1070 Remote File Copy - T1105 Input Capture - T1056 Masquerading - T1036 Network Share Discovery - T1135 Standard Non-Application Layer Protocol - T1095 Obfuscated Files Or Information - T1027 Powershell - T1086 Process Discovery - T1057 Process Injection - T1055 Scheduled Task - T1053 Screen Capture - T1113 Spearphishing Attachment - T1193 System Information Discovery - T1082 System Owner/User Discovery - T1033 System Time Discovery - T1124 User Execution - T1204 Indicator Removal On Host Masquerading Screen Capture Spearphishing Attachment User Execution
Show in Graph
Common Information
Type Value
UUID 972c896d-cc3a-4f42-a87f-550e90fc0aa1
Fingerprint 8b470412e797ff07
Analysis status DONE
Considered CTI value 2
Text language
Published Aug. 16, 2022, midnight
Added to db Sept. 11, 2022, 12:29 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Anomali Cyber Watch: Ransomware Module Added to SOVA Android Trojan, Bitter APT Targets Mobile Phones with Dracarys, China-Sponsored TA428 Deploys Six Backdoors at Once, and More
Title Anomali Cyber Watch: Ransomware Module Added to SOVA Android Trojan, Bitter APT Targets Mobile Phones with Dracarys, China-Sponsored TA428 Deploys Six Backdoors at Once, and More
Detected Hints/Tags/Attributes 201/4/50
Source URLs
Redirection Url
Details Source https://www.anomali.com/blog/anomali-cyber-watch-ransomware-module-added-to-sova-android-trojan-bitter-apt-targets-mobile-phones-with-dracarys-china-sponsored-ta428-deploys-six-backdoors-at-once-and-more
URL Provider
Details Provider Source level domain
Details anomali.com www.anomali.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 270 ✔ — https://www.anomali.com/site/blog-rss 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 63 
cve-2020-0796
Details CVE 45 
cve-2021-1732
Details CVE 38 
cve-2022-24521
Details CVE 217 
cve-2020-1472
Details CVE 375 
cve-2017-11882
Details CVE 6 
cve-2022-24481
Details CVE 9 
cve-2017-11884
Details File 11 
clfs.sys
Details Mandiant Uncategorized Groups 28 
UNC2596
Details MITRE ATT&CK Techniques 409 
T1566
Details MITRE ATT&CK Techniques 238 
T1497
Details MITRE ATT&CK Techniques 40 
T1221
Details MITRE ATT&CK Techniques 420 
T1204
Details MITRE ATT&CK Techniques 492 
T1105
Details MITRE ATT&CK Techniques 627 
T1027
Details MITRE ATT&CK Techniques 504 
T1140
Details MITRE ATT&CK Techniques 480 
T1053
Details MITRE ATT&CK Techniques 1006 
T1082
Details MITRE ATT&CK Techniques 152 
T1056
Details MITRE ATT&CK Techniques 219 
T1113
Details MITRE ATT&CK Techniques 534 
T1005
Details MITRE ATT&CK Techniques 34 
T1025
Details MITRE ATT&CK Techniques 67 
T1039
Details MITRE ATT&CK Techniques 172 
T1555
Details MITRE ATT&CK Techniques 67 
T1074
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 472 
T1486
Details MITRE ATT&CK Techniques 585 
T1083
Details MITRE ATT&CK Techniques 239 
T1106
Details MITRE ATT&CK Techniques 176 
T1135
Details MITRE ATT&CK Techniques 27 
T1558
Details MITRE ATT&CK Techniques 245 
T1203
Details MITRE ATT&CK Techniques 444 
T1071
Details MITRE ATT&CK Techniques 159 
T1095
Details MITRE ATT&CK Techniques 208 
T1068
Details MITRE ATT&CK Techniques 23 
T1123
Details MITRE ATT&CK Techniques 207 
T1547
Details MITRE ATT&CK Techniques 433 
T1057
Details MITRE ATT&CK Techniques 230 
T1033
Details MITRE ATT&CK Techniques 86 
T1124
Details MITRE ATT&CK Techniques 440 
T1055
Details MITRE ATT&CK Techniques 157 
T1560
Details MITRE ATT&CK Techniques 164 
T1574
Details MITRE ATT&CK Techniques 247 
T1070
Details MITRE ATT&CK Techniques 113 
T1552
Details MITRE ATT&CK Techniques 289 
T1003
Details MITRE ATT&CK Techniques 235 
T1562
Details MITRE ATT&CK Techniques 152 
T1090
Details Threat Actor Identifier - APT-C 102 
APT-C-35
Details Threat Actor Identifier by Tencent 13 
T-APT-17