S0678 Torisma

malwareEnterprise

platformsWindows

also known asTorisma

Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.002Software Packing
T1027.013Encrypted/Encoded File
T1041Exfiltration Over C2 Channel
T1049System Network Connections Discovery
T1071.001Web Protocols
T1106Native API
T1124System Time Discovery
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
T1573.001Symmetric Cryptography
T1680Local Storage Discovery

used by campaigns (1)

Campaigns that use this.

C0022Operation Dream Job

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan