MalwareUsed by 1 actor

QUIETBOARD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC4990

"QUIETBOARD is a Python based pre-compiled multi-component backdoor capable of arbitrary command execution, clipboard content manipulation for crypto currency theft, USB/removable drive infection, screenshotting, system information gathering, and communication with the C2 server."

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

“This shortcut is linked to a PowerShell script… explorer.ps1… ‘powershell.exe’ -windowstyle hidden -NoProfile… -ExecutionPolicy ByPass -File explorer.ps1”

T1204User ExecutionEvidence1

“creates a deceptive LNK shortcut… linked to a PowerShell script… named explorer.ps1… Detection Opportunity: LNK shortcut file spawning PowerShell script… T1204 T1059.001”

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

“Encodes a JSON dictionary… Adds ‘AA’ and ‘==’… decode the server's response using Base64… JSON is Base64 encoded and AES encrypted… Key: 4lZYQ/POapYTZka0gVM/rg==”

T1036.005Match Legitimate Resource Name or LocationEvidence1

“Hangul Filler character… visually shows up as a whitespace making the directory path appear as ‘D:\’… Detection Opportunity… Runtime Broker.exe… writes with whitespaces within the binary name… T1036.005”

T1620Reflective Code LoadingEvidence1

“deserialize it using the marshal.loads function. It executes the deserialized data using the exec function… expects to receive Python code in response, which it executes”

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

“Retrieves WIFI SSIDs… ‘netsh wlan show interfaces’… Retrieves BSSID… ‘netsh wlan show networks mode=bssid’”

T1082System Information DiscoveryEvidence1

“info… gather… WMI queries… Win32_OperatingSystem… Win32_ComputerSystem… Win32_Processor… Win32_VideoController”

Collection

2 techniques

T1113Screen CaptureEvidence1

“connection… optionally including a screenshot of the system.”

T1115Clipboard DataEvidence1

“cboard… continuously monitoring and altering the clipboard content… detect… crypto wallet addresses and replace them with its own”

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

“iterates over a list of URLs, attempting to send POST requests containing the request_data… Upon successful communication… decode the server's response… execute… configured C2 server: hxxps://eu1.microtunnel[.]it/c0s1ta/index.php”

T1092Communication Through Removable MediaEvidence1

“coronausb… monitors and infects removable drives… creates a hidden folder… moves existing data… creates a deceptive LNK shortcut… linked to… explorer.ps1”

T1105Ingress Tool TransferEvidence1

“relies on third-party websites such as GitHub, Vimeo, and Ars Technica to host encoded additional stages, which it downloads and decodes via PowerShell early in the execution chain.”

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

QUIETBOARD

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UNC4990

via mandiant threat intelligencecloud.google.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.001PowerShellEvidence1

“This shortcut is linked to a PowerShell script… explorer.ps1… ‘powershell.exe’ -windowstyle hidden -NoProfile… -ExecutionPolicy ByPass -File explorer.ps1”

T1204User ExecutionEvidence1

“creates a deceptive LNK shortcut… linked to a PowerShell script… named explorer.ps1… Detection Opportunity: LNK shortcut file spawning PowerShell script… T1204 T1059.001”

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

“Encodes a JSON dictionary… Adds ‘AA’ and ‘==’… decode the server's response using Base64… JSON is Base64 encoded and AES encrypted… Key: 4lZYQ/POapYTZka0gVM/rg==”

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1620Reflective Code LoadingEvidence1

“deserialize it using the marshal.loads function. It executes the deserialized data using the exec function… expects to receive Python code in response, which it executes”

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence1

“Retrieves WIFI SSIDs… ‘netsh wlan show interfaces’… Retrieves BSSID… ‘netsh wlan show networks mode=bssid’”

T1082System Information DiscoveryEvidence1

“info… gather… WMI queries… Win32_OperatingSystem… Win32_ComputerSystem… Win32_Processor… Win32_VideoController”

Collection

2 techniques

T1113Screen CaptureEvidence1

“connection… optionally including a screenshot of the system.”

T1115Clipboard DataEvidence1

“cboard… continuously monitoring and altering the clipboard content… detect… crypto wallet addresses and replace them with its own”

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

T1092Communication Through Removable MediaEvidence1

“coronausb… monitors and infects removable drives… creates a hidden folder… moves existing data… creates a deceptive LNK shortcut… linked to… explorer.ps1”

T1105Ingress Tool TransferEvidence1

“relies on third-party websites such as GitHub, Vimeo, and Ars Technica to host encoded additional stages, which it downloads and decodes via PowerShell early in the execution chain.”

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.