MITRE ATT&CKsoftware (malware)
S0181 FALLCHILL
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.3
- Created
- 2018-01-16
Description
FALLCHILL is a RAT that has been used by Lazarus Group since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other Lazarus Group malware or delivered when a victim unknowingly visits a compromised website.
Related
Uses · MITRE ATT&CK (9)
- T1680 Local Storage Discovery technique
- T1573.001 Symmetric Cryptography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1543.003 Windows Service sub-technique
- T1016 System Network Configuration Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group
References
- https://www.us-cert.gov/ncas/alerts/TA17-318A US-CERT FALLCHILL Nov 2017