MITRE ATT&CKsoftware (malware)
S0570 BitPaymer
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- wp_encrypt, FriedEx
- Version
- 1.1
- Created
- 2021-02-08
Description
BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. BitPaymer uses a unique encryption key, ransom note, and contact information for each operation. BitPaymer has several indicators suggesting overlap with the Dridex malware and is often delivered via Dridex.
Related
Uses · MITRE ATT&CK (18)
- T1027.013 Encrypted/Encoded File sub-technique
- T1564.004 NTFS File Attributes sub-technique
- T1087.001 Local Account sub-technique
- T1134.001 Token Impersonation/Theft sub-technique
- T1222.001 Windows Permissions sub-technique
- T1070.006 Timestomp sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1490 Inhibit System Recovery technique
- T1486 Data Encrypted for Impact technique
- T1480 Execution Guardrails technique
- T1135 Network Share Discovery technique
- T1007 System Service Discovery technique
- T1012 Query Registry technique
- T1018 Remote System Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G0119 Indrik Spider group