GreyEnergy

Description

GreyEnergy is a backdoor written in C that shares similarities with BlackEnergy, and researchers consider it the successor to that family.

17 techniques across 8 tactics.

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
T1055Process Injection
- T1055.002Portable Executable Injection
T1070Indicator Removal
- T1070.004File Deletion
T1218System Binary Proxy Execution
- T1218.011Rundll32

T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
- T1090.003Multi-hop Proxy
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography
- T1573.001Symmetric Cryptography

Alert Name	Engine
Script-Macro.Trojan.GreyEnergy	ATP Sandbox Adv. Heuristics
Win32.Trojan.GreyEnergy	ATP Sandbox Adv. Heuristics