Malware

Black Energy 2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence1

The ddos plugin uses the socket, connect and send functions to send a GET request to the server.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

A service (which also has a random name) associated with the driver is then created and started.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

The decrypted data is an infector driver which will inject a DLL into the svchost.exe user-mode process.

T1055.004Asynchronous Procedure CallEvidence1

This method uses APC queue processing. First, an APC with the address of the DllEntry function for the library injected is initialized, then the APC is queued using KeInsertQueueApc APC.

T1543.003Windows ServiceEvidence1

A service (which also has a random name) associated with the driver is then created and started.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

This includes encryption and code compression; anti-emulation techniques can also be used.

T1055Process InjectionEvidence1

The decrypted data is an infector driver which will inject a DLL into the svchost.exe user-mode process.

T1055.004Asynchronous Procedure CallEvidence1

This method uses APC queue processing. First, an APC with the address of the DllEntry function for the library injected is initialized, then the APC is queued using KeInsertQueueApc APC.

T1218System Binary Proxy ExecutionEvidence1

Having received the http_start command, the http plugin creates a COM object named “Internet Explorer(Ver 1.0)” with an IWebBrowser2 interface.

T1564Hide ArtifactsEvidence1

Like most other malicious programs, Black Energy 2 has a protective layer that hides the malicious payload from antivirus products. This includes encryption and code compression; anti-emulation techniques can also be used.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The bot sends a preformed http request to the C&C address; this is a string containing data which identifies the infected machine.

T1105Ingress Tool TransferEvidence1

If the bot does not have a particular module or if a newer version is available on the server, the bot will send a plug-in download request to the server.

Impact

2 techniques

T1498Network Denial of ServiceEvidence1

Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy.

T1498.001Direct Network FloodEvidence1

If the former parameter is received, the plugin begins an attack... An attack in this case consists of numerous connection requests being made to the server, followed by so-called ‘handshakes’, i.e. the opening of network sessions.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

May 13, 2021

Black DDoS | Securelist

A modular bot/backdoor primarily used to conduct DDoS attacks. It hides its payload with encryption/packing, injects a DLL into svchost.exe, communicates with C2 over HTTP, downloads encrypted plug-ins, and can execute commands such as updating itself, downloading and executing files, and launching multiple DDoS methods including UDP/TCP/ICMP/HTTP and SYN flooding.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Black Energy 2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1106Native APIEvidence1

The ddos plugin uses the socket, connect and send functions to send a GET request to the server.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

A service (which also has a random name) associated with the driver is then created and started.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

The decrypted data is an infector driver which will inject a DLL into the svchost.exe user-mode process.

T1055.004Asynchronous Procedure CallEvidence1

This method uses APC queue processing. First, an APC with the address of the DllEntry function for the library injected is initialized, then the APC is queued using KeInsertQueueApc APC.

T1543.003Windows ServiceEvidence1

A service (which also has a random name) associated with the driver is then created and started.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

This includes encryption and code compression; anti-emulation techniques can also be used.

T1055Process InjectionEvidence1

The decrypted data is an infector driver which will inject a DLL into the svchost.exe user-mode process.

T1055.004Asynchronous Procedure CallEvidence1

This method uses APC queue processing. First, an APC with the address of the DllEntry function for the library injected is initialized, then the APC is queued using KeInsertQueueApc APC.

T1218System Binary Proxy ExecutionEvidence1

Having received the http_start command, the http plugin creates a COM object named “Internet Explorer(Ver 1.0)” with an IWebBrowser2 interface.

T1564Hide ArtifactsEvidence1

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The bot sends a preformed http request to the C&C address; this is a string containing data which identifies the infected machine.

T1105Ingress Tool TransferEvidence1

If the bot does not have a particular module or if a newer version is available on the server, the bot will send a plug-in download request to the server.

Impact

2 techniques

T1498Network Denial of ServiceEvidence1

Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy.

T1498.001Direct Network FloodEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

May 13, 2021

Black DDoS | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.