ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool SymonLoader

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: SymonLoader

NamesSymonLoader
CategoryMalware
TypeLoader
Description(Palo Alto) When executed, the loader starts monitoring storage device changes on a compromised machine. If SymonLoader detects the targeted type of secure USB drive, it attempts to access the storage through the device driver corresponding to the secure USB and checks for strings specific to one type of secure USB in the drive information fields. Then, it accesses a predefined location of the storage on the USB and extracts an unknown PE file.
Information<https://unit42.paloaltonetworks.com/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:SymonLoader>

Last change to this tool card: 19 April 2020

Download this tool card in JSON format

Previous: Sykipot
Next: SynFlooder

All groups using tool SymonLoader

ChangedNameCountryObserved

APT groups

 Bronze Butler, Tick, RedBaldNight, Stalker PandaChina2010-Apr 2021X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key