Flagpro

MITRE ATT&CK: S0696 View on attack.mitre.org

Aliases: BUSYICE, Flagpro

First seen
2020-10-01 00:00:00
Malware type
downloader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 14:22:29

Targeted industries: defense-and-aerospace media-and-entertainment technology-and-telecommunications

Targeted regions: country_code:jp

Context

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.

Detection coverage

  • 1 YARA rules
  • 491 Sigma rules

Malware & tools used

  • Standard Encoding (attack-pattern)
  • Application Window Discovery (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • System Language Discovery (attack-pattern)
  • Visual Basic (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Data from Local System (attack-pattern)
  • Masquerading (attack-pattern)
  • Malicious File (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Web Protocols (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Local Groups (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Indicator Removal (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Process Discovery (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Flagpro_Auto (yara-rule)

Reports & references

  • jp.security.ntt — En Blacktech 2021 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Flagpro (report)
  • vblocalhost.com — Vb2021 50 (report)
  • insight-jp.nttsecurity.com — Flagpro The New Malware Used By Blacktech (report)
  • cyberandramen.net — More Flagpro More Problems (report)
  • insight-jp.nttsecurity.com — Blacktechflagpro (report)
  • jsac.jpcert.or.jp — Jsac2022 8 Hara En (report)
  • MITRE ATT&CK — S0696 (report)

External references