Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BUSYICE is HTTP client written in C/C++, which works as both backdoor/downloader
BUSYICE is HTTP client written in C/C++, which works as both backdoor/downloader
8 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK ... Initial Access Phishing: Spearphishing Attachment T1566.001 Send SpearPhishing mail with macro-enabled Excel
BUSYICE is HTTP client written in C/C++, which works as both backdoor/downloader ... OS command to execute via cmd.exe; TELESWORD command SHELL Execute arbitrary command via cmd.exe
MITRE ATT&CK ... Persistence Boot or Logon Initialization Scripts: Startup Items T1037.005 BUSYICE/SLEFMAKE is executed through startup
MITRE ATT&CK ... Persistence Boot or Logon Initialization Scripts: Startup Items T1037.005 BUSYICE/SLEFMAKE is executed through startup
MITRE ATT&CK ... Discovery Remote System Discovery T1018 BUSYICE use “net view” to check current network
MITRE ATT&CK ... Discovery Permission Groups Discovery: Local Groups T1069.001 BUSYICE use “net localgroup administrators” to check permission
1ststage backdoor profiles the victim, then downloads 2ndstage backdoor ... BTSDOOR ... Encrypt systeminfo by AES session key ... DELTABEEF 0x00040000 Get detail systeminfo ... TELESWORD COMPUTERINFO Get system info
MITRE ATT&CK ... Command and Control Application Layer Protocol: Web Protocols T1071.001 BUSYICE/SPIDERPIG uses HTTP/HTTPS for C&C communication
Download command “ExecYes”: download file from given URI ... TELESWORD command UPLOADFILE Download file from specified URL or Telegram storage ... SPIDERPIG x64 Download EXE and execute
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.