S0574 BendyBear

malwareEnterprise

platformsWindows

also known asBendyBear

BendyBear is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, BendyBear shares a variety of features with Waterbear, malware previously attributed to the Chinese cyber espionage group BlackTech.

techniques used (11)

ATT&CK techniques this enables or maps to.

T1001.001Junk Data
T1012Query Registry
T1027.013Encrypted/Encoded File
T1027.014Polymorphic Code
T1105Ingress Tool Transfer
T1106Native API
T1124System Time Discovery
T1140Deobfuscate/Decode Files or Information
T1497.003Time Based Checks
T1571Non-Standard Port
T1573.001Symmetric Cryptography

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan