Malware.View on attack.mitre.org
Green Lambert is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of Green Lambert may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.
| Technique | Procedure example |
|---|---|
| T1005 Data from Local System |
Green Lambert can collect data from a compromised host. |
| T1016 System Network Configuration Discovery |
Green Lambert can obtain proxy information from a victim's machine using system environment variables. |
| T1027 Obfuscated Files or Information |
Green Lambert has encrypted strings. |
| T1036.004 Masquerade Task or Service |
Green Lambert has created a new executable named `Software Update Check` to appear legitimate. |
| T1036.005 Match Legitimate Resource Name or Location |
Green Lambert has been disguised as a Growl help file. |
| T1037.004 RC Scripts |
Green Lambert can add |
| T1059.004 Unix Shell |
Green Lambert can use shell scripts for execution, such as |
| T1070.004 File Deletion |
Green Lambert can delete the original executable after initial installation in addition to unused functions. |
| T1071.004 DNS |
Green Lambert can use DNS for C2 communications. |
| T1082 System Information Discovery |
Green Lambert can use `uname` to identify the operating system name, version, and processor type. |
| T1090 Proxy |
Green Lambert can use proxies for C2 traffic. |
| T1124 System Time Discovery |
Green Lambert can collect the date and time from a compromised host. |
| T1140 Deobfuscate/Decode Files or Information |
Green Lambert can use multiple custom routines to decrypt strings prior to execution. |
| T1543.001 Launch Agent |
Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to |
| T1543.004 Launch Daemon |
Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence. |
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
