Home > List all groups > List all tools > List all groups using tool STASHLOG

Threat Group Cards: A Threat Actor Encyclopedia

Names	STASHLOG
Category	Malware
Type	Loader
Description	(Cybereason) STASHLOG (shiver.exe / forsrv.exe) is a 32 bit executable that is being used to prepare the victim machine for further compromise, and to “stash” a malicious, encrypted payload to a CLFS log file. This payload will be decrypted at each phase to deliver the next phase in the infection.
Information	<https://www.cybereason.com/blog/operation-cuckoobees-a-winnti-malware-arsenal-deep-dive> <https://www.mandiant.com/resources/unknown-actor-using-clfs-log-files-for-stealth>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.stashlog>

Last change to this tool card: 27 December 2022

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups