Skip to content

Hide Navigation Hide TOC

Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb)

Sardonic is a backdoor written in C and C++ that is known to be used by FIN8, as early as August 2021 to target a financial institution in the United States. Sardonic has a plugin system that can load specially made DLLs and execute their functions.(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)

Cluster A Galaxy A Cluster B Galaxy B Level
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Asymmetric Cryptography - T1573.002 (bf176076-b789-408e-8cba-7275e81c0ada) Attack Pattern 1
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Non-Standard Port - T1571 (b18eae87-b469-4e14-b454-b171b416bc18) Attack Pattern 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Reflective Code Loading - T1620 (4933e63b-9b77-476e-ab29-761bc5b7d15a) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern 1
Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f) Attack Pattern 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa) Attack Pattern 1
System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add) Attack Pattern 1
Non-Application Layer Protocol - T1095 (c21d5a77-d422-4a69-acd7-2c53c1faa34b) Attack Pattern Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Standard Encoding - T1132.001 (04fd5427-79c7-44ea-ae13-11b24778ff1c) Attack Pattern 1
Sardonic - S1085 (0c52f5bc-557d-4083-bd27-66d7cdb794bb) Malware Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern 1
Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118) Attack Pattern Asymmetric Cryptography - T1573.002 (bf176076-b789-408e-8cba-7275e81c0ada) Attack Pattern 2
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) Attack Pattern Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) Attack Pattern 2
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) Attack Pattern 2
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41) Attack Pattern Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118) Attack Pattern 2
Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377) Attack Pattern Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 2
Data Encoding - T1132 (cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f) Attack Pattern Standard Encoding - T1132.001 (04fd5427-79c7-44ea-ae13-11b24778ff1c) Attack Pattern 2
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62) Attack Pattern 2