NetTravelerMalware
- travnet
NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013.From MITRE ATT&CK
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“We do not simply rely on naïve approaches like monitoring well-known system call sequences for process injection, but efficiently analyze memory to find all known evasion capabilities.”
- T1055.004Asynchronous Procedure Call
“It then periodically wakes up, using an asynchronous procedure call, and executes a ROP chain to mark its payload as executable before jumping to it.”
- T1055.012Process Hollowing
“PROCESS HOLLOWING”
What the reports say
1 report, newest first · the exact sentence from each-
Hunting In Memory“NetTraveler is one malware family that uses a memory module style technique.”
Thanks — we review every report.