MalwareUsed by 2 actors

ECCENTRICBANDWAGON

ECCENTRICBANDWAGON is a Windows malware family publicly associated with North Korean government cyber operations, specifically activity attributed to the BeagleBoyz subgroup within the broader HIDDEN COBRA/Lazarus/APT38 ecosystem. It has been documented in U.S. government malware analysis reporting tied to financially motivated campaigns targeting the banking sector, including operations related to ATM cash-out activity.

The malware supports user surveillance and collection functions including screenshot capture and keylogging. Captured screenshots and keystrokes are stored locally in temporary directories prior to further handling, indicating a staging workflow on compromised hosts. ECCENTRICBANDWAGON also includes cleanup capability, including deletion of malware-generated log files, consistent with anti-forensic tradecraft and operational hygiene.

Observed behavior indicates use on Windows systems and local storage of collected artifacts in temporary locations. The combination of keystroke capture, screen capture, local staging, and artifact deletion makes ECCENTRICBANDWAGON suitable for credential collection and post-compromise monitoring in targeted intrusions. Public reporting links it to North Korea-aligned financially motivated operations rather than broad indiscriminate malware distribution.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

...three Malware Analysis Reports (MAR) were released as well and they are: MAR-10301706.-1.v1 - 4 samples (ECCENTRICBANDWAGON)

via fortinet threat signalfortiguard.fortinet.com

APT38

...three Malware Analysis Reports (MAR) were released as well and they are: MAR-10301706.-1.v1 - 4 samples (ECCENTRICBANDWAGON)

via fortinet threat signalfortiguard.fortinet.com

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1070Indicator RemovalEvidence1

Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Collection

4 techniques

T1056.001KeyloggingEvidence1

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

T1113Screen CaptureEvidence3

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Minor Software changes: ... ECCENTRICBANDWAGON

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Backdoor malware that deletes its generated log files.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Backdoor malware that captures screenshots and stores them locally.

mitre attack websiteNews

May 20, 2015

Data Staged: Local Data Staging, Sub-technique T1074.001 - Enterprise | MITRE ATT&CK®

Surveillance malware that stores keystrokes and screenshots in temporary directories before exfiltration.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ECCENTRICBANDWAGON