ATT&CK SoftwareKazuar

Kazuar

S0265

Malware.View on attack.mitre.org

About this malware

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework.

Techniques used31

Execution3

T1047Windows Management Instrumentation T1059.003Windows Command Shell T1059.004Unix Shell

Persistence3

T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder T1547.009Shortcut Modification

Privilege Escalation4

T1055.001Dynamic-link Library Injection T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder T1547.009Shortcut Modification

Stealth3

T1027Obfuscated Files or Information T1055.001Dynamic-link Library Injection T1070.004File Deletion

Discovery9

T1010Application Window Discovery T1016System Network Configuration Discovery T1033System Owner/User Discovery T1057Process Discovery T1069.001Local Groups T1082System Information Discovery T1083File and Directory Discovery T1087.001Local Account T1680Local Storage Discovery

Collection4

T1005Data from Local System T1074.001Local Data Staging T1113Screen Capture T1125Video Capture

Command and Control7

T1008Fallback Channels T1071.001Web Protocols T1071.002File Transfer Protocols T1090.001Internal Proxy T1102.002Bidirectional Communication T1105Ingress Tool Transfer T1132.001Standard Encoding

Exfiltration1

T1029Scheduled Transfer

Impact1

T1485Data Destruction

Procedure examples31

Technique	Procedure example
T1005 Data from Local System	Kazuar uploads files from a specified directory to the C2 server. Unit 42 Kazuar May 2017
T1008 Fallback Channels	Kazuar can accept multiple URLs for C2 servers. Unit 42 Kazuar May 2017
T1010 Application Window Discovery	Kazuar gathers information about opened windows. Unit 42 Kazuar May 2017
T1016 System Network Configuration Discovery	Kazuar gathers information about network adapters. Unit 42 Kazuar May 2017
T1027 Obfuscated Files or Information	Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher. Unit 42 Kazuar May 2017
T1029 Scheduled Transfer	Kazuar can sleep for a specific time and be set to communicate at specific intervals. Unit 42 Kazuar May 2017
T1033 System Owner/User Discovery	Kazuar gathers information on users. Unit 42 Kazuar May 2017
T1047 Windows Management Instrumentation	Kazuar obtains a list of running processes through WMI querying. Unit 42 Kazuar May 2017
T1055.001 Dynamic-link Library Injection	If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes. Unit 42 Kazuar May 2017
T1057 Process Discovery	Kazuar obtains a list of running processes through WMI querying and the `ps` command. Unit 42 Kazuar May 2017
T1059.003 Windows Command Shell	Kazuar uses cmd.exe to execute commands on the victim’s machine. Unit 42 Kazuar May 2017
T1059.004 Unix Shell	Kazuar uses /bin/bash to execute commands on the victim’s machine. Unit 42 Kazuar May 2017
T1069.001 Local Groups	Kazuar gathers information about local groups and members. Unit 42 Kazuar May 2017
T1070.004 File Deletion	Kazuar can delete files. Unit 42 Kazuar May 2017
T1071.001 Web Protocols	Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API. Unit 42 Kazuar May 2017

View all 31 procedure examples

Groups that use it1

Campaigns0

None recorded.

References1

Unit 42 Kazuar May 2017 Open source
Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.