OdinaffMalware
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“We do not simply rely on naïve approaches like monitoring well-known system call sequences for process injection, but efficiently analyze memory to find all known evasion capabilities.”
- T1055.004Asynchronous Procedure Call
“It then periodically wakes up, using an asynchronous procedure call, and executes a ROP chain to mark its payload as executable before jumping to it.”
- T1055.012Process Hollowing
“PROCESS HOLLOWING”
What the reports say
1 report, newest first · the exact sentence from each-
Hunting In Memory“More recently, Careto and Odinaff malware families have used module overwriting techniques.”
Thanks — we review every report.