S1052 DEADEYE

malwareEnterprise

platformsWindows

also known asDEADEYE · DEADEYE.EMBED · DEADEYE.APPEND

DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).

techniques used (12)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.009Embedded Payloads
T1027.013Encrypted/Encoded File
T1036.004Masquerade Task or Service
T1059.003Windows Command Shell
T1082System Information Discovery
T1106Native API
T1140Deobfuscate/Decode Files or Information
T1218.007Msiexec
T1218.011Rundll32
T1480Execution Guardrails
T1564.004NTFS File Attributes

used by campaigns (1)

Campaigns that use this.

C0017C0017

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan