S0208 Pasam

Pasam is a trojan used by Elderwood to open a backdoor on compromised hosts. ¹ ²

Techniques Used

Domain	ID	Name	Use
enterprise	T1547	Boot or Logon Autostart Execution	-
enterprise	T1547.008	LSASS Driver	Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.²
enterprise	T1005	Data from Local System	Pasam creates a backdoor through which remote attackers can retrieve files.²
enterprise	T1083	File and Directory Discovery	Pasam creates a backdoor through which remote attackers can retrieve lists of files.²
enterprise	T1070	Indicator Removal	-
enterprise	T1070.004	File Deletion	Pasam creates a backdoor through which remote attackers can delete files.²
enterprise	T1105	Ingress Tool Transfer	Pasam creates a backdoor through which remote attackers can upload files.²
enterprise	T1057	Process Discovery	Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.²
enterprise	T1082	System Information Discovery	Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.²

ID	Name	References
G0066	Elderwood	¹