MITRE ATT&CKsoftware (malware)

S0239 Bankshot

Published 2018-10-17 Modified 2025-10-22 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Trojan Manuscript
Version
1.2
Created
2018-10-17

Description

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector.

Related

Uses · MITRE ATT&CK (25)

  • T1680 Local Storage Discovery technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.002 Non-Standard Encoding sub-technique
  • T1571 Non-Standard Port technique
  • T1059.003 Windows Command Shell sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1543.003 Windows Service sub-technique
  • T1203 Exploitation for Client Execution technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1012 Query Registry technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1070 Indicator Removal technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1112 Modify Registry technique
  • T1119 Automated Collection technique

Referenced by MITRE ATT&CK · uses (1)

  • G0032 Lazarus Group group

References