Malware: HyperBro

Description

[HyperBro](https://attack.mitre.org/software/S0398) is a custom in-memory backdoor used by [Threat Group-3390](https://attack.mitre.org/groups/G0027).(Citation: Unit42 Emissary Panda May 2019)(Citation: Securelist LuckyMouse June 2018)(Citation: Hacker News LuckyMouse June 2018)

External References

• mitre-attack
• Unit42 Emissary Panda May 2019
• Hacker News LuckyMouse June 2018
• Securelist LuckyMouse June 2018

Techniques Used by This Malware

• T1007 — System Service Discovery
• T1027.002 — Software Packing
• T1027.013 — Encrypted/Encoded File
• T1055 — Process Injection
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1105 — Ingress Tool Transfer
• T1106 — Native API
• T1113 — Screen Capture
• T1140 — Deobfuscate/Decode Files or Information
• T1569.002 — Service Execution
• T1574.001 — DLL

APT Groups Using This Malware

• Threat Group-3390