Sec
Lookup
Search
MITRE ATT&CK
software (malware)
S0069
BLACKCOFFEE
Published 2017-05-31
Modified 2024-11-17
Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2017-05-31
Description
BLACKCOFFEE
is malware that has been used by several Chinese groups since at least 2013.
Related
Uses · MITRE ATT&CK
(7)
T1102.001
Dead Drop Resolver
sub-technique
T1102.002
Bidirectional Communication
sub-technique
T1059.003
Windows Command Shell
sub-technique
T1070.004
File Deletion
sub-technique
T1057
Process Discovery
technique
T1083
File and Directory Discovery
technique
T1104
Multi-Stage Channels
technique
Referenced by MITRE ATT&CK · uses
(3)
G0096
APT41
group
G0065
Leviathan
group
G0025
APT17
group
References
https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf
FireEye APT17
https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html
FireEye Periscope March 2018