HOMEFRY

S0232

About this malware

HOMEFRY is a 64-bit Windows password dumper/cracker that has previously been used in conjunction with other Leviathan backdoors.

Technique	Procedure example
T1003 OS Credential Dumping	HOMEFRY can perform credential dumping. FireEye Periscope March 2018
T1027.013 Encrypted/Encoded File	Some strings in HOMEFRY are obfuscated with XOR x56. FireEye Periscope March 2018
T1059.003 Windows Command Shell	HOMEFRY uses a command-line interface. FireEye Periscope March 2018

None recorded.

FireEye Periscope March 2018 Open source
FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.