ATT&CK SoftwareLOWBALL

LOWBALL

S0042

Malware.View on attack.mitre.org

About this malware

LOWBALL is malware used by admin@338. It was used in August 2015 in email messages targeting Hong Kong-based media organizations.

Techniques used3

Command and Control3

T1071.001Web Protocols T1102.002Bidirectional Communication T1105Ingress Tool Transfer

Procedure examples3

Technique	Procedure example
T1071.001 Web Protocols	LOWBALL command and control occurs via HTTPS over port 443. FireEye admin@338
T1102.002 Bidirectional Communication	LOWBALL uses the Dropbox cloud storage service for command and control. FireEye admin@338
T1105 Ingress Tool Transfer	LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware. FireEye admin@338

Groups that use it1

Campaigns0

None recorded.

References1

FireEye admin@338 Open source
FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.