HOMEFRY

HOMEFRY is a 64-bit Windows password dumper/cracker that has previously been used in conjunction with other Leviathan backdoors. ^[1]

ID: S0232

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 1.2

Created: 18 April 2018

Last Modified: 11 April 2024

Techniques Used

Domain	ID		Name	Use
Enterprise	T1059	.003	Command and Scripting Interpreter: Windows Command Shell	HOMEFRY uses a command-line interface.^[1]
Enterprise	T1027	.013	Obfuscated Files or Information: Encrypted/Encoded File	Some strings in HOMEFRY are obfuscated with XOR x56.^[1]
Enterprise	T1003		OS Credential Dumping	HOMEFRY can perform credential dumping.^[1]

ID	Name	References
G0065	Leviathan	^[1]