MITRE ATT&CKsoftware (malware)

S0574 BendyBear

Published 2021-02-16 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2021-02-16

Description

BendyBear is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, BendyBear shares a variety of features with Waterbear, malware previously attributed to the Chinese cyber espionage group BlackTech.

Related

Uses · MITRE ATT&CK (11)

  • T1027.014 Polymorphic Code sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.001 Junk Data sub-technique
  • T1571 Non-Standard Port technique
  • T1497.003 Time Based Checks sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1012 Query Registry technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1124 System Time Discovery technique

References