S1210 Sagerunex

malwareEnterprise

platformsWindows

also known asSagerunex

Sagerunex is a malware family exclusively associated with Lotus Blossom operations, with variants existing since at least 2016. Variations of Sagerunex leverage non-traditional command and control mechanisms such as various web services.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.002Software Packing
T1027.013Encrypted/Encoded File
T1041Exfiltration Over C2 Channel
T1055.001Dynamic-link Library Injection
T1057Process Discovery
T1071.001Web Protocols
T1074.001Local Data Staging
T1082System Information Discovery
T1090Proxy
T1102.002Bidirectional Communication
T1102.003One-Way Communication
T1106Native API
T1134Access Token Manipulation
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
T1560.001Archive via Utility
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0030Lotus Blossom

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan