S0208 Pasam

Pasam is a trojan used by Elderwood to open a backdoor on compromised hosts. ² ¹

Techniques Used

Domain	ID	Name	Use
enterprise	T1547	Boot or Logon Autostart Execution	-
enterprise	T1547.008	LSASS Driver	Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.¹
enterprise	T1005	Data from Local System	Pasam creates a backdoor through which remote attackers can retrieve files.¹
enterprise	T1083	File and Directory Discovery	Pasam creates a backdoor through which remote attackers can retrieve lists of files.¹
enterprise	T1070	Indicator Removal	-
enterprise	T1070.004	File Deletion	Pasam creates a backdoor through which remote attackers can delete files.¹
enterprise	T1105	Ingress Tool Transfer	Pasam creates a backdoor through which remote attackers can upload files.¹
enterprise	T1680	Local Storage Discovery	Pasam creates a backdoor through which remote attackers can retrieve information like free disk space.¹
enterprise	T1057	Process Discovery	Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.¹
enterprise	T1082	System Information Discovery	Pasam creates a backdoor through which remote attackers can retrieve information like hostname.¹

ID	Name	References
G0066	Elderwood	²