MITRE ATT&CKsoftware (malware)

S0678 Torisma

Published 2022-02-01 Modified 2024-04-10 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2022-02-01

Description

Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.

Related

Uses · MITRE ATT&CK (13)

  • T1680 Local Storage Discovery technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1027.002 Software Packing sub-technique
  • T1480 Execution Guardrails technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1049 System Network Connections Discovery technique
  • T1106 Native API technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • C0022 Operation Dream Job campaign

References