HAPPYWORK
Happywork is a downloader used by ScarCruft to target South Korean government and financial victims in November 2016. [1]
ID: S0214
Aliases: HAPPYWORK
Type: MALWARE
Platforms: Windows
Version: 1.0
Alias Descriptions
| Name | Description |
|---|---|
| HAPPYWORK | [1] |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1105 | Remote File Copy | can download and execute a second-stage payload.[1] |
| Enterprise | T1082 | System Information Discovery | can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.[1] |
| Enterprise | T1033 | System Owner/User Discovery | can collect the victim user name.[1] |
Groups
Groups that use this software:
APT37