Malware: BabyShark

Description

[BabyShark](https://attack.mitre.org/software/S0414) is a Microsoft Visual Basic (VB) script-based malware family that is believed to be associated with several North Korean campaigns. (Citation: Unit42 BabyShark Feb 2019)

External References

• mitre-attack
• Unit42 BabyShark Apr 2019
• Mandiant APT43 March 2024
• Unit42 BabyShark Feb 2019

Techniques Used by This Malware

• T1012 — Query Registry
• T1016 — System Network Configuration Discovery
• T1033 — System Owner/User Discovery
• T1053.005 — Scheduled Task
• T1056.001 — Keylogging
• T1057 — Process Discovery
• T1059.003 — Windows Command Shell
• T1059.005 — Visual Basic
• T1070.004 — File Deletion
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1105 — Ingress Tool Transfer
• T1132.001 — Standard Encoding
• T1140 — Deobfuscate/Decode Files or Information
• T1218.005 — Mshta
• T1547.001 — Registry Run Keys / Startup Folder

APT Groups Using This Malware

• Kimsuky