GreyEnergy — Malware Profile

GreyEnergy is a backdoor written in C and compiled in Visual Studio. GreyEnergy shares similarities with the BlackEnergy malware and is thought to be the successor of it.

MITRE ATT&CK techniques (17)

• T1003.001 LSASS Memory
• T1007 System Service Discovery
• T1027.002 Software Packing
• T1027.013 Encrypted/Encoded File
• T1055.002 Portable Executable Injection
• T1056.001 Keylogging
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1090.003 Multi-hop Proxy
• T1105 Ingress Tool Transfer
• T1112 Modify Registry
• T1218.011 Rundll32
• T1543.003 Windows Service
• T1553.002 Code Signing
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• Sandworm Team

Read the full analysis on IntelFusions