Search/Sardonic
● Malware

Sardonic

Sardonic is a backdoor written in C and C++ that is known to be used by FIN8, as early as August 2021 to target a financial institution in the United States. Sardonic has a plugin system that can load specially made DLLs and execute their functions.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
26 relationships
T1047: Windows Management Instrumentation
source
T1132.001: Standard Encoding
source
T1573.001: Symmetric Cryptography
source
T1007: System Service Discovery
source
T1135: Network Share Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1620: Reflective Code Loading
source
T1016: System Network Configuration Discovery
source
T1070: Indicator Removal
source
T1055.004: Asynchronous Procedure Call
source
T1049: System Network Connections Discovery
source
T1057: Process Discovery
source
T1546.003: Windows Management Instrumentation Event Subscription
source
T1059.001: PowerShell
source
T1571: Non-Standard Port
source
T1027: Obfuscated Files or Information
source
T1573.002: Asymmetric Cryptography
source
T1095: Non-Application Layer Protocol
source
T1059.003: Windows Command Shell
source
T1027.010: Command Obfuscation
source
T1105: Ingress Tool Transfer
source
T1680: Local Storage Discovery
source