DUSTPANMalware
- StealthVector
DUSTPAN is an in-memory dropper written in C/C++ used by APT41 since 2021 that decrypts and executes an embedded payload.From MITRE ATT&CK
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“For example, WerFault.exe and wermgr.exe are among the most attractive targets for masquerading:”
- T1055.012Process Hollowing
“Excluding it by process.executable creates an evasion opportunity via process hollowing or injection, which can make the process tree look normal.”
What the reports say
1 report, newest first · the exact sentence from each-
Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks“See below for a screenshot detecting Nighthawk, BruteRatel, CobaltStrike, and ATP41’s StealthVector.”
Thanks — we review every report.