Home > List all groups > List all tools > List all groups using tool SPARKLOG

Threat Group Cards: A Threat Actor Encyclopedia

Names	SPARKLOG
Category	Malware
Type	Loader
Description	(Cybereason) SPARKLOG (spark.exe) is a 32 bit executable written in C++, employed in this attack to extract a DLL from the CLFS file, decrypt it and then launch it for side-loading by Windows services running as SYSTEM. Executing this phase of the attack successfully enables the attackers to gain Privilege Escalation and also Persistence in a specific case.
Information	<https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive>

Last change to this tool card: 19 July 2022

Download this tool card in JSON format

Previous: Spark
Next: SparkRAT

1 group listed (1 APT, 0 other, 0 unknown)

APT groups