Malware: Truvasys

Description

[Truvasys](https://attack.mitre.org/software/S0178) is first-stage malware that has been used by [PROMETHIUM](https://attack.mitre.org/groups/G0056). It is a collection of modules written in the Delphi programming language. (Citation: Microsoft Win Defender Truvasys Sep 2017) (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)

External References

• mitre-attack
• Microsoft Win Defender Truvasys Sep 2017
• Microsoft NEODYMIUM Dec 2016
• Microsoft SIR Vol 21

Techniques Used by This Malware

• T1036.004 — Masquerade Task or Service
• T1547.001 — Registry Run Keys / Startup Folder

APT Groups Using This Malware

• PROMETHIUM