Torisma
- ID
- S0678
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Apr 2024
Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.[1]
Techniques used (13)
- T1016 System Network Configuration Discovery
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1041 Exfiltration Over C2 Channel
- T1049 System Network Connections Discovery
- T1071.001 Web Protocols
- T1106 Native API
- T1124 System Time Discovery
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1573.001 Symmetric Cryptography
- T1680 Local Storage Discovery