Daserf
Software · ATTACK:enterprise:S0187
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0187",
"title": "Daserf",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0187",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--b6b3dfc7-9a81-43ff-ac04-698bad48973a",
"external_id": "S0187",
"domain": "enterprise",
"created": "2018-01-16T16:13:52.465Z",
"modified": "2025-04-25T14:44:29.509Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Daserf"
},
{
"source_name": "Muirim"
},
{
"source_name": "Nioupale"
},
{
"source_name": "Trend Micro Daserf Nov 2017",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"
},
{
"source_name": "Secureworks BRONZE BUTLER Oct 2017",
"url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03c08ef9-80c7-4f20-b197-ad44f702f2e0
Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f2e2727-ffe5-42ad-93fc-e856303ca684
Symantec Tick Apr 2016ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24503815-4ac5-4d57-9e95-ebeb84e0c11b
Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f507d82-1df4-4c9c-804a-2e6060944142
Trend Micro Daserf Nov 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4abcf209-1dab-435b-a347-b8ff318ac5d8
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57527643-2aef-4171-b61a-665ab8ed991b
Symantec Tick Apr 2016ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6db82410-1fcf-483a-be5b-cf09c361b4eb
Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92b34cc0-b059-4294-824f-bb92298f3ae6
Trend Micro Daserf Nov 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1001.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a566127b-1d88-4b38-84dd-4686e2837399
Trend Micro Daserf Nov 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce9dbe5b-1b16-41d6-a7af-a2a1b33c4552
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d297b77f-9511-429a-b148-d7b8f0b5b502
Symantec Tick Apr 2016ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2bc1c1b-987b-4a1a-b488-8199f8113697
Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6204645-83ff-4b26-a011-9b58bab2d597
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6b4cd9a-a8bd-4c9f-b716-e29710f1e934
Symantec Tick Apr 2016ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df6c39fa-9d95-45ee-911b-0ca2fc167086
Symantec Tick Apr 2016ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e79c65f4-f9d2-4568-96a4-b6e00d3bad71
Trend Micro Daserf Nov 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0187
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f52f1b34-a96a-45a0-8cc0-2f138a3f1257
Trend Micro Daserf Nov 2017 · Symantec Tick Apr 2016