สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool LEMONSTICK

Threat Group Cards: A Threat Actor Encyclopedia

Tool: LEMONSTICK

Names	LEMONSTICK
Category	Malware
Type	Backdoor, Tunneling
Description	(FireEye) LEMONSTICK is a Linux executable command line utility with backdoor capabilities. The backdoor can execute files, transfer files, and tunnel connections. LEMONSTICK can be started in two different ways: passing the `-c` command line argument (with an optional file) and setting the ‘OCB’ environment variable. When started with the `-c` command line argument, LEMONSTICK spawns an interactive shell. When started in OCB mode, LEMONSTICK expects to read from STDIN. The STDIN data is expected to be encrypted with the blowfish algorithm. After decrypting, it dispatches commands based on the name—for example: ‘executes terminal command’, ‘connect to remote system’, ‘send & retrieve file’, ‘create socket connection’.
Information	<https://www.mandiant.com/resources/live-off-the-land-an-overview-of-unc1945>

Last change to this tool card: 03 April 2022

Download this tool card in JSON format

Previous: Leash
Next: LEMPO

All groups using tool LEMONSTICK

Changed	Name	Country	Observed
APT groups
	LightBasin	[Unknown]	2016

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]