ATT&CK SoftwareBADCALL

BADCALL

S0245

Malware.View on attack.mitre.org

About this malware

BADCALL is a Trojan malware variant used by the group Lazarus Group.

Techniques used8

Persistence1

T1112Modify Registry

Defense Impairment2

T1112Modify Registry T1686.003Windows Host Firewall

Discovery2

T1016System Network Configuration Discovery T1082System Information Discovery

Command and Control4

T1001.003Protocol or Service Impersonation T1090Proxy T1571Non-Standard Port T1573.001Symmetric Cryptography

Procedure examples8

Technique	Procedure example
T1001.003 Protocol or Service Impersonation	BADCALL uses a FakeTLS method during C2. Malware Analysis Report 10135536-G
T1016 System Network Configuration Discovery	BADCALL collects the network adapter information. US-CERT BADCALL
T1082 System Information Discovery	BADCALL collects the computer name and host name on the compromised system. US-CERT BADCALL
T1090 Proxy	BADCALL functions as a proxy server between the victim and C2 server. US-CERT BADCALL
T1112 Modify Registry	BADCALL modifies the firewall Registry key `SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List`. US-CERT BADCALL
T1571 Non-Standard Port	BADCALL communicates on ports 443 and 8000 with a FakeTLS method. US-CERT BADCALL
T1573.001 Symmetric Cryptography	BADCALL encrypts C2 traffic using an XOR/ADD cipher. US-CERT BADCALL
T1686.003 Windows Host Firewall	BADCALL disables the Windows firewall before binding to a port. US-CERT BADCALL

Groups that use it1

Campaigns0

None recorded.

References1

US-CERT BADCALL Open source
US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.