S0462 CARROTBAT

malwareEnterprise

platformsWindows

also known asCARROTBAT

CARROTBAT is a customized dropper that has been in use since at least 2017. CARROTBAT has been used to install SYSCON and has infrastructure overlap with KONNI.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1027.010Command Obfuscation
T1027.013Encrypted/Encoded File
T1059.003Windows Command Shell
T1070.004File Deletion
T1082System Information Discovery
T1105Ingress Tool Transfer

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan