Malware: NanHaiShu

Description

[NanHaiShu](https://attack.mitre.org/software/S0228) is a remote access tool and JScript backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065). [NanHaiShu](https://attack.mitre.org/software/S0228) has been used to target government and private-sector organizations that have relations to the South China Sea dispute. (Citation: Proofpoint Leviathan Oct 2017) (Citation: fsecure NanHaiShu July 2016)

External References

• mitre-attack
• Proofpoint Leviathan Oct 2017
• fsecure NanHaiShu July 2016

Techniques Used by This Malware

• T1016 — System Network Configuration Discovery
• T1027.013 — Encrypted/Encoded File
• T1033 — System Owner/User Discovery
• T1059.005 — Visual Basic
• T1059.007 — JavaScript
• T1070.004 — File Deletion
• T1071.004 — DNS
• T1082 — System Information Discovery
• T1105 — Ingress Tool Transfer
• T1218.005 — Mshta
• T1547.001 — Registry Run Keys / Startup Folder
• T1562.001 — Disable or Modify Tools

APT Groups Using This Malware

• Leviathan