Kerrdown

Description

Kerrdown is a custom downloader that the APT32 intrusion set has used since at least 2018 to install spyware from servers on victims' networks.

11 techniques across 5 tactics.

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.015Compression
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

Alert Name	Engine
Document-Word.Trojan.Kerrdown	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Kerrdown	ATP Sandbox Adv. Heuristics
Win32.Trojan.Kerrdown	ATP Sandbox Adv. Heuristics

Signature Name	Engine
MALWARE-CNC Win.Trojan.KerrDown download attempt	IPS-SWG