S0124 Pisloader

malwareEnterprise

platformsWindows

also known asPisloader

Pisloader is a malware family that is notable due to its use of DNS as a C2 protocol as well as its use of anti-analysis tactics. It has been used by APT18 and is similar to another malware family, HTTPBrowser, that has been used by the group.

techniques used (9)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1059.003Windows Command Shell
T1071.004DNS
T1082System Information Discovery
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G0026APT18

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan