MITRE ATT&CKsoftware (malware)

S0448 Rising Sun

Published 2020-05-14 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Version
2.1
Created
2020-05-14

Description

Rising Sun is a modular backdoor that was used extensively in Operation Sharpshooter between 2017 and 2019. Rising Sun infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed Rising Sun included some source code from Lazarus Group's Trojan Duuzer.

Related

Uses · MITRE ATT&CK (20)

  • T1680 Local Storage Discovery technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1070.004 File Deletion sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1070 Indicator Removal technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

  • C0013 Operation Sharpshooter campaign

References