LATENTBOT: Trace Me If You Can
概要
FireEye Labs recently uncovered LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.
Through our Dynamic Threat Intelligence (DTI), we have observed multiple campaigns targeting multiple industries in the United States, United Kingdom, South Korea, Brazil, United Arab Emirates, Singapore, Canada, Peru and Poland – primarily in the financial services and insurance sectors. Although the infection strategy is not new, the final payload dropped – which we named LATENTBOT – caught our attention since it implements several layers of obfuscation, a unique exfiltration mechanism, and has been very successful at infecting multiple organizations.
Source : https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html
Created: 2026-02-23
Indicators
Indicatorsは見つかっていない。
類似Pulses
このPulseに関連する脅威アクター (事実ベース)
Score: 21.48
Matched TTPs:
- T1132.001 - Standard Encoding
- T1606.002 - SAML Tokens
- T1588.001 - Malware
- T1608.005 - Link Target
- T1057 - Process Discovery
- T1218.010 - Regsvr32
- T1547.008 - LSASS Driver
- T1086 - PowerShell
MITREへのリンク →
Score: 3.84
Matched TTPs:
- T1132.001 - Standard Encoding
MITREへのリンク →
Score: 13.72
Matched TTPs:
- T1132.001 - Standard Encoding
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1057 - Process Discovery
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 21.05
Matched TTPs:
- T1216.001 - PubPrn
- T1193 - Spearphishing Attachment
- T1136.002 - Domain Account
- T1122 - Component Object Model Hijacking
- T1065 - Uncommonly Used Port
- T1588.005 - Exploits
MITREへのリンク →
Score: 28.79
Matched TTPs:
- T1044 - File System Permissions Weakness
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1021.006 - Windows Remote Management
- T1552.003 - Shell History
- T1608.005 - Link Target
- T1102.003 - One-Way Communication
- T1690 - Prevent Command History Logging
- T1601.001 - Patch System Image
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 11.93
Matched TTPs:
- T1564.008 - Email Hiding Rules
- T1005 - Data from Local System
- T1136.002 - Domain Account
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 36.03
Matched TTPs:
- T1564.008 - Email Hiding Rules
- T1114 - Email Collection
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1005 - Data from Local System
- T1193 - Spearphishing Attachment
- T1049 - System Network Connections Discovery
- T1122 - Component Object Model Hijacking
- T1102.003 - One-Way Communication
- T1187 - Forced Authentication
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 11.05
Matched TTPs:
- T1682 - Query Public AI Services
- T1091 - Replication Through Removable Media
- T1543.002 - Systemd Service
MITREへのリンク →
Score: 34.09
Matched TTPs:
- T1114 - Email Collection
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1683.001 - Written Content
- T1588.001 - Malware
- T1552.003 - Shell History
- T1608.005 - Link Target
- T1057 - Process Discovery
- T1102.003 - One-Way Communication
- T1690 - Prevent Command History Logging
- T1601.001 - Patch System Image
- T1008 - Fallback Channels
MITREへのリンク →
Score: 25.77
Matched TTPs:
- T1114 - Email Collection
- T1164 - Re-opened Applications
- T1049 - System Network Connections Discovery
- T1057 - Process Discovery
- T1102.003 - One-Way Communication
- T1065 - Uncommonly Used Port
- T1574.002 - DLL Side-Loading
MITREへのリンク →
Score: 17.66
Matched TTPs:
- T1114 - Email Collection
- T1091 - Replication Through Removable Media
- T1149 - LC_MAIN Hijacking
- T1690 - Prevent Command History Logging
- T1218.010 - Regsvr32
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 5.30
Matched TTPs:
- T1114 - Email Collection
- T1608.005 - Link Target
MITREへのリンク →
Score: 6.71
Matched TTPs:
- T1606.002 - SAML Tokens
- T1588.001 - Malware
- T1552.003 - Shell History
MITREへのリンク →
Score: 11.93
Matched TTPs:
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1005 - Data from Local System
- T1218.010 - Regsvr32
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 12.28
Matched TTPs:
- T1606.002 - SAML Tokens
- T1021.006 - Windows Remote Management
- T1136.002 - Domain Account
- T1588.001 - Malware
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 6.53
Matched TTPs:
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1136.002 - Domain Account
MITREへのリンク →
Score: 19.95
Matched TTPs:
- T1606.002 - SAML Tokens
- T1608.005 - Link Target
- T1122 - Component Object Model Hijacking
- T1218.010 - Regsvr32
- T1218.009 - Regsvcs/Regasm
- T1223 - Compiled HTML File
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 6.48
Matched TTPs:
- T1606.002 - SAML Tokens
- T1552.003 - Shell History
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 3.59
Matched TTPs:
- T1606.002 - SAML Tokens
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.84
Matched TTPs:
- T1606.002 - SAML Tokens
- T1122 - Component Object Model Hijacking
MITREへのリンク →
Score: 12.05
Matched TTPs:
- T1606.002 - SAML Tokens
- T1136.002 - Domain Account
- T1608.005 - Link Target
- T1218.001 - Compiled HTML File
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 10.86
Matched TTPs:
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1608.005 - Link Target
- T1102.003 - One-Way Communication
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.07
Matched TTPs:
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
MITREへのリンク →
Score: 21.49
Matched TTPs:
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1011.001 - Exfiltration Over Bluetooth
- T1588.001 - Malware
- T1608.005 - Link Target
- T1057 - Process Discovery
- T1065 - Uncommonly Used Port
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 6.44
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1136.002 - Domain Account
- T1608.005 - Link Target
MITREへのリンク →
Score: 10.07
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1136.002 - Domain Account
- T1608.005 - Link Target
- T1218.001 - Compiled HTML File
MITREへのリンク →
Score: 8.31
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1136.002 - Domain Account
- T1608.005 - Link Target
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 9.98
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1608.005 - Link Target
- T1601.001 - Patch System Image
- T1086 - PowerShell
MITREへのリンク →
Score: 5.26
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1102.003 - One-Way Communication
MITREへのリンク →
Score: 10.35
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1218.003 - CMSTP
- T1122 - Component Object Model Hijacking
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 6.30
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1136.002 - Domain Account
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 5.56
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1588.001 - Malware
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 9.44
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1588.001 - Malware
- T1608.005 - Link Target
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 7.46
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1065 - Uncommonly Used Port
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 5.48
Matched TTPs:
- T1091 - Replication Through Removable Media
- T1608.005 - Link Target
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.54
Matched TTPs:
- T1055.003 - Thread Execution Hijacking
MITREへのリンク →
Score: 10.53
Matched TTPs:
- T1218.003 - CMSTP
- T1552.003 - Shell History
- T1608.005 - Link Target
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 5.34
Matched TTPs:
- T1193 - Spearphishing Attachment
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 6.42
Matched TTPs:
- T1136.002 - Domain Account
- T1588.001 - Malware
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 7.80
Matched TTPs:
- T1136.002 - Domain Account
- T1187 - Forced Authentication
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.55
Matched TTPs:
- T1136.002 - Domain Account
- T1588.001 - Malware
MITREへのリンク →
Score: 8.83
Matched TTPs:
- T1136.002 - Domain Account
- T1552.003 - Shell History
- T1588.005 - Exploits
MITREへのリンク →
Score: 5.72
Matched TTPs:
- T1588.001 - Malware
- T1218.001 - Compiled HTML File
MITREへのリンク →
Score: 3.96
Matched TTPs:
- T1588.001 - Malware
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 6.48
Matched TTPs:
- T1588.001 - Malware
- T1601.001 - Patch System Image
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 7.80
Matched TTPs:
- T1588.001 - Malware
- T1601.001 - Patch System Image
- T1588.005 - Exploits
MITREへのリンク →
Score: 4.11
Matched TTPs:
- T1588.001 - Malware
- T1608.005 - Link Target
MITREへのリンク →
Score: 16.88
Matched TTPs:
- T1588.001 - Malware
- T1608.005 - Link Target
- T1187 - Forced Authentication
- T1601.001 - Patch System Image
- T1098.002 - Additional Email Delegate Permissions
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 3.59
Matched TTPs:
- T1588.001 - Malware
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.62
Matched TTPs:
- T1588.001 - Malware
- T1552.003 - Shell History
MITREへのリンク →
Score: 11.01
Matched TTPs:
- T1588.001 - Malware
- T1218.010 - Regsvr32
- T1574.002 - DLL Side-Loading
- T1008 - Fallback Channels
MITREへのリンク →
Score: 8.38
Matched TTPs:
- T1049 - System Network Connections Discovery
- T1608.005 - Link Target
- T1122 - Component Object Model Hijacking
MITREへのリンク →
Score: 5.12
Matched TTPs:
- T1049 - System Network Connections Discovery
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 5.37
Matched TTPs:
- T1608.005 - Link Target
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 9.54
Matched TTPs:
- T1608.005 - Link Target
- T1057 - Process Discovery
- T1122 - Component Object Model Hijacking
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 3.51
Matched TTPs:
- T1608.005 - Link Target
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 4.76
Matched TTPs:
- T1608.005 - Link Target
- T1122 - Component Object Model Hijacking
MITREへのリンク →
Score: 4.61
Matched TTPs:
- T1122 - Component Object Model Hijacking
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 4.24
Matched TTPs:
- T1122 - Component Object Model Hijacking
- T1218.010 - Regsvr32
MITREへのリンク →
Score: 6.14
Matched TTPs:
- T1218.001 - Compiled HTML File
- T1547.008 - LSASS Driver
MITREへのリンク →
Score: 3.36
Matched TTPs:
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 6.64
Matched TTPs:
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
- T1008 - Fallback Channels
MITREへのリンク →
Score: 3.36
Matched TTPs:
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 4.78
Matched TTPs:
- T1218.010 - Regsvr32
- T1008 - Fallback Channels
MITREへのリンク →
Score: 3.29
Matched TTPs:
- T1008 - Fallback Channels
MITREへのリンク →
Score: 3.29
Matched TTPs:
- T1008 - Fallback Channels
MITREへのリンク →
このPulseに関連する脅威アクター (推論ベース)
Score: 0.86
Matched TTPs:
- T1122 - Component Object Model Hijacking
- T1606.002 - SAML Tokens
- T1102.003 - One-Way Communication
- T1091 - Replication Through Removable Media
- T1049 - System Network Connections Discovery
- T1114 - Email Collection
- T1564.008 - Email Hiding Rules
- T1193 - Spearphishing Attachment
- T1005 - Data from Local System
- T1187 - Forced Authentication
- T1218.010 - Regsvr32
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 0.78
Matched TTPs:
- T1008 - Fallback Channels
- T1606.002 - SAML Tokens
- T1102.003 - One-Way Communication
- T1091 - Replication Through Removable Media
- T1552.003 - Shell History
- T1114 - Email Collection
- T1690 - Prevent Command History Logging
- T1057 - Process Discovery
- T1588.001 - Malware
- T1683.001 - Written Content
- T1608.005 - Link Target
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 0.68
Matched TTPs:
- T1547.008 - LSASS Driver
- T1606.002 - SAML Tokens
- T1102.003 - One-Way Communication
- T1091 - Replication Through Removable Media
- T1552.003 - Shell History
- T1044 - File System Permissions Weakness
- T1690 - Prevent Command History Logging
- T1021.006 - Windows Remote Management
- T1608.005 - Link Target
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 0.63
Matched TTPs:
- T1102.003 - One-Way Communication
- T1049 - System Network Connections Discovery
- T1114 - Email Collection
- T1164 - Re-opened Applications
- T1057 - Process Discovery
- T1574.002 - DLL Side-Loading
- T1065 - Uncommonly Used Port
MITREへのリンク →
Score: 0.58
Matched TTPs:
- T1011.001 - Exfiltration Over Bluetooth
- T1606.002 - SAML Tokens
- T1091 - Replication Through Removable Media
- T1588.001 - Malware
- T1057 - Process Discovery
- T1608.005 - Link Target
- T1065 - Uncommonly Used Port
- T1601.001 - Patch System Image
MITREへのリンク →
Score: 0.56
Matched TTPs:
- T1547.008 - LSASS Driver
- T1606.002 - SAML Tokens
- T1588.001 - Malware
- T1132.001 - Standard Encoding
- T1218.010 - Regsvr32
- T1057 - Process Discovery
- T1608.005 - Link Target
- T1086 - PowerShell
MITREへのリンク →
Related CVEs
このPulseに見つかったCVEはありません。
Pulse – 脅威アクター グラフ
← Pulse一覧に戻る