gsecdump — Malware Profile

gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems.

MITRE ATT&CK techniques (2)

• T1003.002 Security Account Manager
• T1003.004 LSA Secrets

Attributed threat actors

• PittyTiger
• BRONZE BUTLER
• APT27
• APT1
• Tonto Team

Read the full analysis on IntelFusions