1. Home
  2. Software
  3. LOWBALL

LOWBALL

LOWBALL is malware used by admin@338. It was used in August 2015 in email messages targeting Hong Kong-based media organizations. [1]

ID: S0042
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 30 March 2020
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

LOWBALL command and control occurs via HTTPS over port 443.[1]
Enterprise T1105 Ingress Tool Transfer

LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.[1]
Enterprise T1102 .002 Web Service: Bidirectional Communication

LOWBALL uses the Dropbox cloud storage service for command and control.[1]

Groups That Use This Software

ID Name References
G0018 admin@338

[1]

References

  1. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.