S1082 Sunbird

malwareMobile

platformsAndroid

also known asSunbird

Sunbird is one of two mobile malware families known to be used by the APT Confucius. Analysis suggests that Sunbird was first active in early 2017. While Sunbird and Hornbill overlap in core capabilities, Sunbird has a more extensive set of malicious features.

techniques used (17)

ATT&CK techniques this enables or maps to.

T1409Stored Application Data
T1418Software Discovery
T1422System Network Configuration Discovery
T1426System Information Discovery
T1429Audio Capture
T1430Location Tracking
T1512Video Capture
T1513Screen Capture
T1532Archive Collected Data
T1533Data from Local System
T1544Ingress Tool Transfer
T1623.001Unix Shell
T1626.001Device Administrator Permissions
T1636.001Calendar Entries
T1636.002Call Log
T1636.003Contact List
T1646Exfiltration Over C2 Channel

used by groups (1)

Threat groups associated with this.

G0142Confucius

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan