[Intel]: https://mp-weixin-qq-com.translate.goog/s/zHLY81XeNL8afYaPtd0Myw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

[timb-machine]

Area

Malware reports

Parent threat

Persistence, Defense Evasion, Discovery, Command and Control

Finding

https://mp-weixin-qq-com.translate.goog/s/zHLY81XeNL8afYaPtd0Myw?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en

Industry reference

attack:T1027:Obfuscated Files or Information
attack:T1053.003:Cron
attack:T1082:System Information Discovery
attack:T1132:Data Encoding
attack:T1564.001:Hidden Files and Directories

Malware reference

Buni

Actor reference

APT32
Ocean Lotus

Component

No response

Scenario

No response