STEELHOUND
Description
(Mandiant) Mandiant discovered UNC2891 leveraging a similar (STEELCORGI) in-memory dropper that also used environment variables to decrypt its embedded payload but instead relied on RC4 encryption, we have named this STEELHOUND. In addition to functioning as dropper for an embedded payload, STEELHOUND is also able to encrypt new payloads by encrypting a target binary and writing it to disk along with a copy of itself and an end-of-file configuration.
Names
| Name |
|---|
| STEELHOUND |
Category
Malware
Type
- Dropper
Information
Other Information
Uuid
7ba6ed83-c174-4edc-8e35-1a8ad536b511
Last Card Change
2022-04-03