Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Farseer – named due to a string found in the PDB path embedded within the executable files... is a backdoor trojan that we can trace back in our data to 2016 and that we continue to see in 2019.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
A VBScript component is used, via a registry persistence hook, to launch the Microsoft executable and the Farseer payload during the user login process.
A VBScript component is used, via a registry persistence hook, to launch the Microsoft executable and the Farseer payload during the user login process.
Defence evasion T1140 Deobfuscate / decode files or information Mixture of compression, obfuscation and encryption used for components of Farseer malware, including config files and further payloads.
The contents of the file, assuming a victim clicked on the URL in the spear-phishing email, resembles the structure used in a technique known as AppLocker Bypass whereby trusted Windows executables can be used to execute malicious payloads.
T1071: Standard application layer protocol HenBox used HTTP to communicate with the C2.
83 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.