MalwareUsed by 1 actor

Netboy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

the threat actor breached the DLP company’s internal update servers to deliver malware within its network. It then trojanized legitimate tool installers used by the firm, leading to malware being executed on two of its customers’ computers.

T1195.002Compromise Software Supply ChainEvidence2

Tick compromised update servers to deliver malicious update packages via the software developed by the compromised company.

Persistence

2 techniques

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Privilege Escalation

4 techniques

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Netboy, ShadowPy, and their loader use encrypted: payloads, strings, configuration. Loaders contain garbage code.

T1027.001Binary PaddingEvidence1

Netboy and ShadowPy loaders DLLs are padded to avoid security solutions from uploading samples.

T1036.004Masquerade Task or ServiceEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence1

weeks later began introducing trojanized copies of the Q-Dir installers.

Discovery

6 techniques

T1033System Owner/User DiscoveryEvidence1

Netboy and ReVBShell, gather user information.

T1057Process DiscoveryEvidence1

Netboy and ReVBShell have process enumeration capabilities.

T1082System Information DiscoveryEvidence1

Netboy and ReVBShell, gather system information.

T1120Peripheral Device DiscoveryEvidence1

Netboy enumerates all available drives.

T1124System Time DiscoveryEvidence1

Netboy uses system time to contact its C&C only during a certain time range.

T1135Network Share DiscoveryEvidence1

Netboy has network discovery capabilities.

Collection

2 techniques

T1039Data from Network Shared DriveEvidence1

Netboy and ReVBShell have capabilities to collect files.

T1113Screen CaptureEvidence1

Netboy has screenshot capabilities.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

During the intrusion, the attackers deployed a previously undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader

T1573Encrypted ChannelEvidence1

Netboy uses RC4. ShadowPy uses AES.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Netboy and ReVBShell have exfiltration capabilities.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

infosecurity magazine comNews

Mar 15, 2023

Tick APT Group Hacked East Asian DLP Software Firm

A backdoor used by Tick in the campaign, likely to provide persistent access on compromised systems.

eset welivesecurity blogNews

Mar 14, 2023

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

A Delphi backdoor that communicates with its C2 over TCP and supports extensive remote administration functions, including screen capture, mouse and keyboard control, file and service manipulation, reverse shell creation, process management, and system/network reconnaissance.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Netboy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

BRONZE BUTLER ... Tools ... ABK, BBK, Casper, Daserf, Datper, DGet, down_new, Ghostdown, Gofarer, gsecdump, Mimikatz, MSGet, Netboy, RarStar, Screen Capture Tool, ShadowPad, ShadowPy, T-SMB

via secureworkssecureworks.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1195Supply Chain CompromiseEvidence1

T1195.002Compromise Software Supply ChainEvidence2

Tick compromised update servers to deliver malicious update packages via the software developed by the compromised company.

Persistence

2 techniques

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Privilege Escalation

4 techniques

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

T1543.003Windows ServiceEvidence1

Netboy and ShadowPy loaders persist by creating a service.

T1547.001Registry Run Keys / Startup FolderEvidence1

Netboy and ShadowPy loaders persist via a Run key.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Netboy, ShadowPy, and their loader use encrypted: payloads, strings, configuration. Loaders contain garbage code.

T1027.001Binary PaddingEvidence1

Netboy and ShadowPy loaders DLLs are padded to avoid security solutions from uploading samples.

T1036.004Masquerade Task or ServiceEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Netboy and ShadowPy loaders use legitimate service and description names when creating services.

T1055.002Portable Executable InjectionEvidence1

Netboy and ShadowPy loaders inject a PE into a preconfigured system process.

T1055.003Thread Execution HijackingEvidence1

Netboy and ShadowPy loaders hijack the main thread of the system process to transfer execution to the injected malware.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence1

weeks later began introducing trojanized copies of the Q-Dir installers.

Discovery

6 techniques

T1033System Owner/User DiscoveryEvidence1

Netboy and ReVBShell, gather user information.

T1057Process DiscoveryEvidence1

Netboy and ReVBShell have process enumeration capabilities.

T1082System Information DiscoveryEvidence1

Netboy and ReVBShell, gather system information.

T1120Peripheral Device DiscoveryEvidence1

Netboy enumerates all available drives.

T1124System Time DiscoveryEvidence1

Netboy uses system time to contact its C&C only during a certain time range.

T1135Network Share DiscoveryEvidence1

Netboy has network discovery capabilities.

Collection

2 techniques

T1039Data from Network Shared DriveEvidence1

Netboy and ReVBShell have capabilities to collect files.

T1113Screen CaptureEvidence1

Netboy has screenshot capabilities.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

During the intrusion, the attackers deployed a previously undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader

T1573Encrypted ChannelEvidence1

Netboy uses RC4. ShadowPy uses AES.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Netboy and ReVBShell have exfiltration capabilities.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

domain●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

infosecurity magazine comNews

Mar 15, 2023

Tick APT Group Hacked East Asian DLP Software Firm

A backdoor used by Tick in the campaign, likely to provide persistent access on compromised systems.

eset welivesecurity blogNews

Mar 14, 2023

The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.