BendyBear
- ID
- S0574
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Apr 2024
BendyBear is an x64 shellcode for a stage-zero implant designed to download malware from a C2 server. First discovered in August 2020, BendyBear shares a variety of features with Waterbear, malware previously attributed to the Chinese cyber espionage group BlackTech.[1]
Techniques used (11)
- T1001.001 Junk Data
- T1012 Query Registry
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1497.003 Time Based Checks
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography