MITRE ATT&CKsoftware (malware)

S0526 KGH_SPY

Published 2020-11-06 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2020-11-06

Description

KGH_SPY is a modular suite of tools used by Kimsuky for reconnaissance, information stealing, and backdoor capabilities. KGH_SPY derived its name from PDB paths and internal names found in samples containing "KGH".

Related

Uses · MITRE ATT&CK (20)

  • T1680 Local Storage Discovery technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1555.004 Windows Credential Manager sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1056.001 Keylogging sub-technique
  • T1555 Credentials from Password Stores technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1037.001 Logon Script (Windows) sub-technique
  • T1518 Software Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References