defection.io

malware

Bankshot S0239

Type: malware
Platform: Windows
Created: 17 October 2018
Last modified: 22 October 2025

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector. [1]

TechniquesTop 12%

TacticsTop 11%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

Bankshot S0239

Type: malware
Platform: Windows
Created: 17 October 2018
Last modified: 22 October 2025

TechniquesTop 12%

TacticsTop 11%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Bankshot MITRE reference S0239

Protocol or Service Impersonation T1001.003 ↗

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.2

Command and Control3 detection rules

Data from Local System T1005 ↗

Bankshot collects files from the local system.3

Collection22 detection rules

Query Registry T1012 ↗

Bankshot searches for certain Registry keys to be configured before executing the payload.4

Discovery27 detection rules

Exfiltration Over C2 Channel T1041 ↗

Bankshot exfiltrates data over its C2 channel.5

Exfiltration16 detection rules

Process Discovery T1057 ↗

Bankshot identifies processes and collects the process ids.6

Discovery10 detection rules

Windows Command Shell T1059.003 ↗

Bankshot uses the command-line interface to execute arbitrary commands.7 8

Execution63 detection rules

Standing S0239

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques25Top 12%

88th percentile · 88% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics9Top 11%

89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique27med66th pct

66th percentile · 66% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique6med55th pct

55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 25 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 561Splunk ESCU (cumulative) · 304