MITRE ATT&CKsoftware (malware)

S0666 Gelsemium

Published 2021-11-30 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Gelsevirine, Gelsenicine, Gelsemine
Version
1.2
Created
2021-11-30

Description

Gelsemium is a modular malware comprised of a dropper (Gelsemine), a loader (Gelsenicine), and main (Gelsevirine) plug-ins written using the Microsoft Foundation Class (MFC) framework. Gelsemium has been used by the Gelsemium group since at least 2014.

Related

Uses · MITRE ATT&CK (33)

  • T1027.015 Compression sub-technique
  • T1027.016 Junk Code Insertion sub-technique
  • T1027.011 Fileless Storage sub-technique
  • T1620 Reflective Code Loading technique
  • T1547.012 Print Processors sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.003 Windows Command Shell sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1559.001 Component Object Model sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1497 Virtualization/Sandbox Evasion technique
  • T1134 Access Token Manipulation technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1008 Fallback Channels technique
  • T1012 Query Registry technique
  • T1033 System Owner/User Discovery technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
Show all 33 ›

References