Search/Gelsemium
● Malware

Gelsemium

Gelsemium is a modular malware comprised of a dropper (Gelsemine), a loader (Gelsenicine), and main (Gelsevirine) plug-ins written using the Microsoft Foundation Class (MFC) framework. Gelsemium has been used by the Gelsemium group since at least 2014.

View graph Watch Export
Indicators tracked
0
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
36 relationships
T1027.011: Fileless Storage
source
T1033: System Owner/User Discovery
source
T1548.002: Bypass User Account Control
source
T1071.004: DNS
source
T1036.005: Match Legitimate Resource Name or Location
source
T1543.003: Windows Service
source
T1547.012: Print Processors
source
T1559.001: Component Object Model
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1070.006: Timestomp
source
T1620: Reflective Code Loading
source
T1112: Modify Registry
source
T1027.016: Junk Code Insertion
source
T1083: File and Directory Discovery
source
T1568: Dynamic Resolution
source
T1497: Virtualization/Sandbox Evasion
source
T1057: Process Discovery
source
T1547.001: Registry Run Keys / Startup Folder
source
T1036.001: Invalid Code Signature
source
T1095: Non-Application Layer Protocol
source
T1012: Query Registry
source
T1518.001: Security Software Discovery
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1134: Access Token Manipulation
source
T1071.001: Web Protocols
source
T1105: Ingress Tool Transfer
source
T1008: Fallback Channels
source
T1055.001: Dynamic-link Library Injection
source
T1027.015: Compression
source