Malware: Brave Prince

Description

[Brave Prince](https://attack.mitre.org/software/S0252) is a Korean-language implant that was first observed in the wild in December 2017. It contains similar code and behavior to [Gold Dragon](https://attack.mitre.org/software/S0249), and was seen along with [Gold Dragon](https://attack.mitre.org/software/S0249) and [RunningRAT](https://attack.mitre.org/software/S0253) in operations surrounding the 2018 Pyeongchang Winter Olympics. (Citation: McAfee Gold Dragon)

External References

• mitre-attack
• McAfee Gold Dragon

Techniques Used by This Malware

• T1012 — Query Registry
• T1016 — System Network Configuration Discovery
• T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol
• T1057 — Process Discovery
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1562.001 — Disable or Modify Tools

APT Groups Using This Malware

• Kimsuky