Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)

Bonadan is a malicious version of OpenSSH which acts as a custom backdoor. Bonadan has been active since at least 2018 and combines a new cryptocurrency-mining module with the same credential-stealing module used by the Onderon family of backdoors.(Citation: ESET ForSSHe December 2018)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	Compromise Host Software Binary - T1554 (960c3c86-1480-4d72-b4e0-8c242e84a5c5)	Attack Pattern	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	1
Resource Hijacking - T1496 (cd25c1b4-935c-4f0e-ba8d-552f28bc4783)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	Bonadan - S0486 (4c6d62c2-89f5-4159-8fab-0190b1f9d328)	Malware	1
Encrypted Channel - T1573 (b8902400-e6c5-4ba2-95aa-2d35b442b118)	Attack Pattern	Symmetric Cryptography - T1573.001 (24bfaeba-cb0d-4525-b3dc-507c77ecec41)	Attack Pattern	2