ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Brave Prince

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Brave Prince

NamesBrave Prince
CategoryMalware
TypeReconnaissance, Backdoor
Description(McAfee) Brave Prince is a Korean-language implant that contains similar code and behavior to the Gold Dragon variants, specifically the system profiling and control server communication mechanism. The malware gathers detailed logs about the victim’s configuration, contents of the hard drive, registry, scheduled tasks, running processes, and more. Brave Prince was first observed in the wild December 13, 2017, sending logs to the attacker via South Korea’s Daum email service. Later variants posted the data to a web server via an HTTP post command, in the same way that Gold Dragon does.
Information<https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/>
MITRE ATT&CK<https://attack.mitre.org/software/S0252/>

Last change to this tool card: 22 April 2020

Download this tool card in JSON format

Previous: Brambul
Next: BreachRAT

All groups using tool Brave Prince

ChangedNameCountryObserved

APT groups

 HadesRussia2017-Oct 2020 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key