"description":"OLDBAIT is a credential harvester used by APT28. (Citation: FireEye APT28) (Citation: FireEye APT28) January 2017\n\nAliases: OLDBAIT, Sasfis",
"description":"CosmicDuke is malware that was used by APT29 from 2010 to 2015. (Citation: F-Secure The Dukes)\n\nAliases: CosmicDuke, TinyBaron, BotgenStudios, NemesisGemina",
"description":"H1N1 is a malware variant that has been distributed via a campaign using VBA macros to infect victims. Although it initially had only loader capabilities, it has evolved to include information-stealing functionality. (Citation: Cisco H1N1 Part 1)\n\nAliases: H1N1",
"description":"SPACESHIP is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)\n\nAliases: SPACESHIP",
"description":"Hi-Zor is a remote access tool (RAT) that has characteristics similar to Sakula. It was used in a campaign named INOCNATION. (Citation: Fidelis Hi-Zor)\n\nAliases: Hi-Zor",
"description":"TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017. (Citation: FireEye FIN7 March 2017)\n\nAliases: DNSMessenger, TEXTMATE",
"description":"Net Crawler is an intranet worm capable of extracting credentials using credential dumpers and spreading to systems on a network over SMB by brute forcing accounts with recovered passwords and using PsExec to execute a copy of Net Crawler. (Citation: Cylance Cleaver)\n\nAliases: Net Crawler, NetC",
"description":"BlackEnergy is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3. (Citation: F-Secure BlackEnergy 2014)\n\nAliases: BlackEnergy, Black Energy",
"description":" (Citation: XAgentOSX) is a trojan that has been used by APT28 on OS X and appears to be a port of their standard CHOPSTICK or XAgent trojan. (Citation: XAgentOSX)\n\nAliases: (Citation: XAgentOSX)",
"description":"Pisloader is a malware family that is notable due to its use of DNS as a C2 protocol as well as its use of anti-analysis tactics. It has been used by APT18 and is similar to another malware family, HTTPBrowser, that has been used by the group. (Citation: Palo Alto DNS Requests)\n\nAliases: Pisloader",
"description":"Backdoor.Oldrea is a backdoor used by Dragonfly. It appears to be custom malware authored by the group or specifically for it. (Citation: Symantec Dragonfly)\n\nAliases: Backdoor.Oldrea, Havex",
"description":"Starloader is a loader component that has been observed loading Felismus and associated tools. (Citation: Symantec Sowbug Nov 2017)\n\nAliases: Starloader\n\nContributors: Alan Neville, @abnev",
"description":"ChChes is a Trojan that appears to be used exclusively by menuPass. It was used to target Japanese organizations in 2016. Its lack of persistence methods suggests it may be intended as a first-stage tool. (Citation: Palo Alto menuPass Feb 2017) (Citation: JPCERT ChChes Feb 2017) (Citation: PWC Cloud Hopper Technical Annex April 2017)\n\nAliases: ChChes, Scorpion, HAYMAKER",
"description":"Hacking Team UEFI Rootkit is a rootkit developed by the company Hacking Team as a method of persistence for remote access software. (Citation: TrendMicro Hacking Team UEFI)\n\nAliases: Hacking Team UEFI Rootkit",
"description":"Hydraq is a data-theft trojan first used by Elderwood in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including APT17. (Citation: MicroFocus 9002 Aug 2016) (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Trojan.Hydraq Jan 2010) (Citation: ASERT Seven Pointed Dagger Aug 2015) (Citation: FireEye DeputyDog 9002 November 2013) (Citation: ProofPoint GoT 9002 Aug 2017) (Citation: FireEye Sunshop Campaign May 2013) (Citation: PaloAlto 3102 Sept 2015)\n\nAliases: Hydraq, Aurora, 9002 RAT",
"description":"httpclient is malware used by Putter Panda. It is a simple tool that provides a limited range of functionality, suggesting it is likely used as a second-stage or supplementary/backup tool. (Citation: CrowdStrike Putter Panda)\n\nAliases: httpclient",
"description":"Downdelph is a first-stage downloader written in Delphi that has been used by APT28 in rare instances between 2013 and 2015. (Citation: ESET Sednit Part 3)\n\nAliases: Downdelph, Delphacy",
"description":"CCBkdr is malware that was injected into a signed version of CCleaner and distributed from CCleaner's distribution website. (Citation: Talos CCleanup 2017) (Citation: Intezer Aurora Sept 2017)\n\nAliases: CCBkdr",
"description":"StreamEx is a malware family that has been used by Deep Panda since at least 2015. In 2016, it was distributed via legitimate compromised Korean websites. (Citation: Cylance Shell Crew Feb 2017)\n\nAliases: StreamEx",
"description":"Psylo is a shellcode-based Trojan that has been used by Scarlet Mimic. It has similar characteristics as FakeM. (Citation: Scarlet Mimic Jan 2016)\n\nAliases: Psylo",
"description":"HDoor is malware that has been customized and used by the Naikon group. (Citation: Baumgartner Naikon 2015)\n\nAliases: HDoor, Custom HDoor",
"description":"Smoke Loader is a bot that has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. (Citation: Malwarebytes SmokeLoader 2016)\n\nAliases: Smoke Loader, Dofoil",
"description":" (Citation: Janicab) is an OS X trojan that relied on a valid developer ID and oblivious users to install it. (Citation: Janicab)\n\nAliases: (Citation: Janicab)",
"description":"ZeroT is a Trojan used by TA459, often in conjunction with PlugX. (Citation: Proofpoint TA459 April 2017) (Citation: Proofpoint ZeroT Feb 2017)\n\nAliases: ZeroT",
"description":"CloudDuke is malware that was used by APT29 in 2015. (Citation: F-Secure The Dukes) (Citation: Securelist Minidionis July 2015)\n\nAliases: CloudDuke, MiniDionis, CloudLook",
"description":"RedLeaves is a malware family used by menuPass. The code overlaps with PlugX and may be based upon the open source tool Trochilus. (Citation: PWC Cloud Hopper Technical Annex April 2017) (Citation: FireEye APT10 April 2017)\n\nAliases: RedLeaves, BUGJUICE",
"description":"MobileOrder is a Trojan intended to compromise Android mobile devices. It has been used by Scarlet Mimic. (Citation: Scarlet Mimic Jan 2016)\n\nAliases: MobileOrder",
"description":"Duqu is a malware platform that uses a modular approach to extend functionality after deployment within a target network. (Citation: Symantec W32.Duqu)\n\nAliases: Duqu",
"description":"is a downloader used by APT37 to target South Korean government and financial victims in November 2016. (Citation: FireEye APT37 Feb 2018)\n\nAliases: HAPPYWORK",
"description":"SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)\n\nAliases: SHIPSHAPE",
"description":"T9000 is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. (Citation: FireEye admin@338 March 2014) (Citation: Palo Alto T9000 Feb 2016)\n\nAliases: T9000",
"description":"EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns. (Citation: PWC Cloud Hopper Technical Annex April 2017)\n\nAliases: EvilGrab",
"description":"BS2005 is malware that was used by Ke3chang in spearphishing campaigns since at least 2011. (Citation: Villeneuve et al 2014)\n\nAliases: BS2005",
"description":"WEBC2 is a backdoor used by APT1 to retrieve a Web page from a predetermined C2 server. (Citation: Mandiant APT1 Appendix)\n\nAliases: WEBC2",
"description":"PlugX is a remote access tool (RAT) that uses modular plugins. (Citation: Lastline PlugX Analysis) It has been used by multiple threat groups. (Citation: FireEye Clandestine Fox Part 2) (Citation: New DragonOK) (Citation: Dell TG-3390)\n\nAliases: PlugX, Sogu, Kaba, Korplug",
"description":"Reaver is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the \"Five Poisons,\" which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of . (Citation: Palo Alto Reaver Nov 2017)\n\nAliases: Reaver",
"description":"Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to (Citation: XAgentOSX) (Citation: XAgentOSX) (Citation: Sofacy Komplex Trojan).\n\nAliases: Komplex",
"description":"Taidoor is malware that has been used since at least 2010, primarily to target Taiwanese government organizations. (Citation: TrendMicro Taidoor)\n\nAliases: Taidoor",
"description":"MoonWind is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand. (Citation: Palo Alto MoonWind March 2017)\n\nAliases: MoonWind",
"description":"Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims. (Citation: Proofpoint Operation Transparent Tribe March 2016)\n\nAliases: Crimson, MSIL/Crimson",
"description":"Rover is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan. (Citation: Palo Alto Rover)\n\nAliases: Rover",
"description":"ZLib is a full-featured backdoor that was used as a second-stage implant by Dust Storm from 2014 to 2015. It is malware and should not be confused with the compression library from which its name is derived. (Citation: Cylance Dust Storm)\n\nAliases: ZLib",
"description":"PowerDuke is a backdoor that was used by APT29 in 2016. It has primarily been delivered through Microsoft Word or Excel attachments containing malicious macros. (Citation: Volexity PowerDuke November 2016)\n\nAliases: PowerDuke",
"description":"HTTPBrowser is malware that has been used by several threat groups. (Citation: ThreatStream Evasion Analysis) (Citation: Dell TG-3390) It is believed to be of Chinese origin. (Citation: ThreatConnect Anthem)\n\nAliases: HTTPBrowser, Token Control, HttpDump",
"description":"HAMMERTOSS is a backdoor that was used by APT29 in 2015. (Citation: FireEye APT29) (Citation: F-Secure The Dukes)\n\nAliases: HAMMERTOSS, HammerDuke, NetDuke",
"description":"PoisonIvy is a popular remote access tool (RAT) that has been used by many groups. (Citation: FireEye Poison Ivy)\n\nAliases: PoisonIvy, Poison Ivy",
"description":"Carbanak is a remote backdoor used by a group of the same name (Carbanak). It is intended for espionage, data exfiltration, and providing remote access to infected machines. (Citation: Kaspersky Carbanak)\n\nAliases: Carbanak, Anunak",
"description":"POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater. (Citation: Unit 42 MuddyWater Nov 2017)\n\nAliases: POWERSTATS",
"description":"BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. (Citation: Forcepoint Monsoon)\n\nAliases: BADNEWS",
"description":"FLIPSIDE is a simple tool similar to Plink that is used by FIN5 to maintain access to victims. (Citation: Mandiant FIN5 GrrCON Oct 2016)\n\nAliases: FLIPSIDE",
"value":"FLIPSIDE - S0173",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0173",
"https://www.youtube.com/watch?v=fevGZs0EQu8"
],
"external_id":"S0173",
"synonyms":[
"FLIPSIDE"
]
},
"uuid":"0e18b800-906c-4e44-a143-b11c72b3448b"
},
{
"description":"Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)\n\nAliases: Flame, Flamer, sKyWIper",
"description":"Daserf is a backdoor that has been used to spy on and steal from Japanese, South Korean, Russian, Singaporean, and Chinese victims. Researchers have identified versions written in both Visual C and Delphi. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)\n\nAliases: Daserf, Muirim, Nioupale",
"description":"CozyCar is malware that was used by APT29 from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality. (Citation: F-Secure The Dukes)\n\nAliases: CozyCar, CozyDuke, CozyBear, Cozer, EuroAPT",
"description":"Mivast is a backdoor that has been used by Deep Panda. It was reportedly used in the Anthem breach. (Citation: Symantec Black Vine)\n\nAliases: Mivast",
"description":"is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012. (Citation: FireEye APT33 Sept 2017) (Citation: McAfee Netwire Mar 2015) (Citation: FireEye APT33 Webinar Sept 2017)\n\nAliases: NETWIRE",
"description":"ISMInjector is a Trojan used to install another OilRig backdoor, ISMAgent. (Citation: OilRig New Delivery Oct 2017)\n\nAliases: ISMInjector\n\nContributors: Robert Falcone",
"description":"is a trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Vasport May 2012)\n\nAliases: Vasport",
"description":"XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee. (Citation: Crowdstrike DNC June 2016) (Citation: Invincea XTunnel) (Citation: ESET Sednit Part 2)\n\nAliases: XTunnel, X-Tunnel, XAPS",
"description":"Naid is a trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Naid June 2012)\n\nAliases: Naid",
"description":"Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. (Citation: Dell Sakula)\n\nAliases: Sakula, Sakurel, VIPER",
"description":"Agent.btz is a worm that primarily spreads itself via removable devices such as USB drives. It reportedly infected U.S. military networks in 2008. (Citation: Securelist Agent.btz)\n\nAliases: Agent.btz",
"description":"Prikormka is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. (Citation: ESET Operation Groundbait)\n\nAliases: Prikormka",
"description":"NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.” (Citation: FireEye APT30)\n\nAliases: NETEAGLE",
"description":"SLOWDRIFT is a backdoor used by APT37 against academic and strategic victims in South Korea. (Citation: FireEye APT37 Feb 2018)\n\nAliases: SLOWDRIFT",
"description":"USBStealer is malware that has used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. (Citation: ESET Sednit USBStealer 2014) (Citation: Kaspersky Sofacy)\n\nAliases: USBStealer, USB Stealer, Win32/USBStealer",
"description":"A Linux rootkit that provides backdoor access and hides from defenders.\n\nAliases: Umbreon",
"value":"Umbreon - S0221",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0221"
],
"external_id":"S0221",
"synonyms":[
"Umbreon"
]
},
"uuid":"3d8e547d-9456-4f32-a895-dc86134e282f"
},
{
"description":"Wingbird is a backdoor that appears to be a version of commercial software FinFisher. It is reportedly used to attack individual computers instead of networks. It was used by NEODYMIUM in a May 2016 campaign. (Citation: Microsoft SIR Vol 21) (Citation: Microsoft NEODYMIUM Dec 2016)\n\nAliases: Wingbird",
"description":"is a Trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Nerex May 2012)\n\nAliases: Nerex",
"description":"Regin is a malware platform that has targeted victims in a range of industries, including telecom, government, and financial institutions. Some Regin timestamps date back to 2003. (Citation: Kaspersky Regin)\n\nAliases: Regin",
"description":"AutoIt backdoor is malware that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352. (Citation: Forcepoint Monsoon) This malware makes use of the legitimate scripting language for Windows GUI automation with the same name.\n\nAliases: AutoIt backdoor",
"description":"POWRUNER is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: FireEye APT34 Dec 2017)\n\nAliases: POWRUNER",
"description":"Power Loader is modular code sold in the cybercrime market used as a downloader in malware families such as Carberp, Redyms and Gapz. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nAliases: Power Loader, Win32/Agent.UAW",
"description":"RARSTONE is malware used by the Naikon group that has some characteristics similar to PlugX. (Citation: Aquino RARSTONE)\n\nAliases: RARSTONE",
"description":"PUNCHBUGGY is a dynamic-link library (DLL) downloader utilized by FIN8. (Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016)\n\nAliases: PUNCHBUGGY",
"description":"Matroyshka is a malware framework used by CopyKittens that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)\n\nAliases: Matroyshka",
"description":"Orz is a custom JavaScript backdoor used by Leviathan. It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)\n\nAliases: Orz, AIRBREAK",
"description":"Trojan.Karagany is a backdoor primarily used for recon. The source code for it was leaked in 2010 and it is sold on underground forums. (Citation: Symantec Dragonfly)\n\nAliases: Trojan.Karagany",
"description":"CHOPSTICK is malware family of modular backdoors used by APT28. It has been used from at least November 2012 to August 2016 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. (Citation: FireEye APT28) (Citation: ESET Sednit Part 2) (Citation: FireEye APT28) January 2017\n\nAliases: CHOPSTICK, SPLM, Xagent, X-Agent, webhp",
"description":"is a rootkit trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Darkmoon Aug 2005)\n\nAliases: Darkmoon",
"description":"MiniDuke is malware that was used by APT29 from 2010 to 2015. The MiniDuke toolset consists of multiple downloader and backdoor components. The loader has been used with other MiniDuke components as well as in conjunction with CosmicDuke and PinchDuke. (Citation: F-Secure The Dukes)\n\nAliases: MiniDuke",
"description":"BBSRAT is malware with remote access tool functionality that has been used in targeted compromises. (Citation: Palo Alto Networks BBSRAT)\n\nAliases: BBSRAT",
"description":"Elise is a custom backdoor Trojan that appears to be used exclusively by Lotus Blossom. It is part of a larger group of\ntools referred to as LStudio, ST Group, and APT0LSTU. (Citation: Lotus Blossom Jun 2015)\n\nAliases: Elise, BKDR_ESILE, Page",
"description":"KOMPROGO is a signature backdoor used by APT32 that is capable of process, file, and registry management. (Citation: FireEye APT32 May 2017)\n\nAliases: KOMPROGO",
"description":"POWERSOURCE is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly available tool DNS_TXT_Pwnage. It was observed in February 2017 in spearphishing campaigns against personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. The malware was delivered when macros were enabled by the victim and a VBS script was dropped. (Citation: FireEye FIN7 March 2017) (Citation: Cisco DNSMessenger March 2017)\n\nAliases: POWERSOURCE, DNSMessenger",
"description":"Pasam is a trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Pasam May 2012)\n\nAliases: Pasam",
"description":"Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain. (Citation: Sophos ZeroAccess)\n\nAliases: Zeroaccess, Trojan.Zeroaccess",
"description":"is a rootkit trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Linfo May 2012)\n\nAliases: Linfo",
"description":"Skeleton Key is malware used to inject false credentials into domain controllers with the intent of creating a backdoor password. (Citation: Dell Skeleton) Functionality similar to Skeleton Key is included as a module in Mimikatz.\n\nAliases: Skeleton Key",
"description":"Shamoon is malware that was first used by an Iranian group known as the \"Cutting Sword of Justice\" in 2012. The 2.0 version was seen in 2016 targeting Middle Eastern states. (Citation: FireEye Shamoon Nov 2016) (Citation: Palo Alto Shamoon Nov 2016)\n\nAliases: Shamoon, Disttrack",
"description":"FALLCHILL is a RAT that has been used by Lazarus Group since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other Lazarus Group malware or delivered when a victim unknowingly visits a compromised website. (Citation: US-CERT FALLCHILL Nov 2017)\n\nAliases: FALLCHILL",
"value":"FALLCHILL - S0181",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0181",
"https://www.us-cert.gov/ncas/alerts/TA17-318A"
],
"external_id":"S0181",
"synonyms":[
"FALLCHILL"
]
},
"uuid":"fece06b7-d4b1-42cf-b81a-5323c917546e"
},
{
"description":"Briba is a trojan used by Elderwood to open a backdoor and download files on to compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Briba May 2012)\n\nAliases: Briba",
"description":"Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. It has been used since at least 2013 to target the government, financial, automotive, and media industries. Its primary delivery mechanism is suspected to be spearphishing. (Citation: US-CERT Volgmer Nov 2017)\n\nAliases: Volgmer",
"value":"Volgmer - S0180",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0180",
"https://www.us-cert.gov/ncas/alerts/TA17-318B"
],
"external_id":"S0180",
"synonyms":[
"Volgmer"
]
},
"uuid":"495b6cdb-7b5a-4fbc-8d33-e7ef68806d08"
},
{
"description":"TDTESS is a 64-bit .NET binary backdoor used by CopyKittens. (Citation: ClearSky Wilted Tulip July 2017)\n\nAliases: TDTESS",
"description":"TURNEDUP is a non-public backdoor. It has been dropped by APT33's DROPSHOT malware (also known as Stonedrill). (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)\n\nAliases: TURNEDUP",
"description":"BOOTRASH is a Bootkit that targets Windows operating systems. It has been used by threat actors that target the financial sector. (Citation: MTrends 2016)\n\nAliases: BOOTRASH",
"description":"China Chopper is a Web shell hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. (Citation: Lee 2013) It has been used by several threat groups. (Citation: Dell TG-3390) (Citation: FireEye Periscope March 2018)\n\nAliases: China Chopper",
"description":"Wiper is a family of destructive malware used in March 2013 during breaches of South Korean banks and media companies. (Citation: Dell Wiper)\n\nAliases: Wiper",
"description":"Unknown Logger is a publicly released, free backdoor. Version 1.5 of the backdoor has been used by the actors responsible for the MONSOON campaign. (Citation: Forcepoint Monsoon)\n\nAliases: Unknown Logger",
"description":"gh0st is a remote access tool (RAT). The source code is public and it has been used by many groups. (Citation: FireEye Hacking Team)\n\nAliases: gh0st",
"description":"is a backdoor used by APT37 that has been used to target South Korean government and military organizations in 2017. It is typically dropped using a Hangul Word Processor (HWP) exploit. (Citation: FireEye APT37 Feb 2018)\n\nAliases: DOGCALL",
"description":"Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. (Citation: Palo Alto OilRig May 2016)\n\nAliases: Helminth\n\nContributors: Robert Falcone",
"description":"CORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL. It has also been referred to as Sofacy, though that term has been used widely to refer to both the group APT28 and malware families associated with the group. (Citation: FireEye APT28) (Citation: FireEye APT28) January 2017\n\nAliases: CORESHELL, SOURFACE",
"description":"Remsec is a modular backdoor that has been used by Strider and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. (Citation: Symantec Strider Blog)\n\nAliases: Remsec, Backdoor.Remsec, ProjectSauron",
"description":"FLASHFLOOD is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)\n\nAliases: FLASHFLOOD",
"description":"TINYTYPHON is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)\n\nAliases: TINYTYPHON",
"description":"Gazer is a backdoor used by Turla since at least 2016. (Citation: ESET Gazer Aug 2017)\n\nAliases: Gazer, WhiteBear\n\nContributors: Bartosz Jerzman",
"description":"SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar. (Citation: F-Secure The Dukes)\n\nAliases: SeaDuke, SeaDaddy, SeaDesk",
"description":"HALFBAKED is a malware family consisting of multiple components intended to establish persistence in victim networks. (Citation: FireEye FIN7 April 2017)\n\nAliases: HALFBAKED",
"description":"ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 2)\n\nAliases: ADVSTORESHELL, NETUI, EVILTOSS, AZZY, Sedreco",
"description":"SNUGRIDE is a backdoor that has been used by menuPass as first stage malware. (Citation: FireEye APT10 April 2017)\n\nAliases: SNUGRIDE",
"description":"Linux malware that compromises systems by brute force attacks against SSH services. Once installed, it provides a reverse shell to its controllers, triggered by unsolicited packets\n\nAliases: Chaos",
"value":"Chaos - S0220",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0220"
],
"external_id":"S0220",
"synonyms":[
"Chaos"
]
},
"uuid":"5bcd5511-6756-4824-a692-e8bb109364af"
},
{
"description":"NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of victims. The earliest known samples have timestamps back to 2005, and the largest number of observed samples were created between 2010 and 2013. (Citation: Kaspersky NetTraveler)\n\nAliases: NetTraveler",
"description":"RemoteCMD is a custom tool used by APT3 to execute commands on a remote system similar to SysInternal's PSEXEC functionality. (Citation: Symantec Buckeye)\n\nAliases: RemoteCMD",
"description":"P2P ZeuS is a closed-source fork of the leaked version of the ZeuS botnet. It presents improvements over the leaked version, including a peer-to-peer architecture. (Citation: Dell P2P ZeuS)\n\nAliases: P2P ZeuS, Peer-to-Peer ZeuS, Gameover ZeuS",
"description":" (Citation: FinFisher) is a government-grade commercial surveillance reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. (Citation: FinFisher) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)\n\nAliases: (Citation: FinFisher), FinSpy",
"description":"ComRAT is a remote access tool suspected of being a decedent of Agent.btz and used by Turla. (Citation: Symantec Waterbug) (Citation: NorthSec 2015 GData Uroburos Tools)\n\nAliases: ComRAT",
"description":"POSHSPY is a backdoor that has been used by APT29 since at least 2015. It appears to be used as a secondary backdoor used if the actors lost access to their primary backdoors. (Citation: FireEye POSHSPY April 2017)\n\nAliases: POSHSPY",
"description":"is a backdoor used by PLATINUM that is similar to Dipsind. (Citation: Microsoft PLATINUM April 2016)\n\nAliases: adbupd\n\nContributors: Ryan Becwar",
"value":"adbupd - S0202",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0202"
],
"external_id":"S0202",
"synonyms":[
"adbupd"
]
},
"uuid":"0f1ad2ef-41d4-4b7a-9304-ddae68ea3005"
},
{
"description":"Felismus is a modular backdoor that has been used by Sowbug. (Citation: Symantec Sowbug Nov 2017) (Citation: Forcepoint Felismus Mar 2017)\n\nAliases: Felismus",
"description":"Truvasys is first-stage malware that has been used by PROMETHIUM. It is a collection of modules written in the Delphi programming language. (Citation: Microsoft Win Defender Truvasys Sep 2017) (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)\n\nAliases: Truvasys",
"description":"Winnti is a Trojan that has been used by multiple groups to carry out intrusions in varied regions from at least 2010 to 2016. One of the groups using this malware is referred to by the same name, Winnti Group; however, reporting indicates a second distinct group, Axiom, also uses the malware. (Citation: Kaspersky Winnti April 2013) (Citation: Microsoft Winnti Jan 2017) (Citation: Novetta Winnti April 2015)\n\nAliases: Winnti",
"description":"RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). (Citation: ESET RTM Feb 2017)\n\nAliases: RTM",
"description":"CallMe is a Trojan designed to run on Apple OSX. It is based on a publicly available tool called Tiny SHell. (Citation: Scarlet Mimic Jan 2016)\n\nAliases: CallMe",
"description":"HIDEDRV is a rootkit used by APT28. It has been deployed along with Downdelph to execute and hide that malware. (Citation: ESET Sednit Part 3) (Citation: Sekoia HideDRV Oct 2016)\n\nAliases: HIDEDRV",
"description":"Hikit is malware that has been used by (Citation: Axiom) for late-stage persistence and exfiltration after the initial compromise. (Citation: Axiom)\n\nAliases: Hikit",
"description":"ASPXSpy is a Web shell. It has been modified by Threat Group-3390 actors to create the ASPXTool version. (Citation: Dell TG-3390)\n\nAliases: ASPXSpy, ASPXTool",
"description":"Dipsind is a malware family of backdoors that appear to be used exclusively by PLATINUM. (Citation: Microsoft PLATINUM April 2016)\n\nAliases: Dipsind\n\nContributors: Ryan Becwar",
"value":"Dipsind - S0200",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0200"
],
"external_id":"S0200",
"synonyms":[
"Dipsind"
]
},
"uuid":"e170995d-4f61-4f17-b60e-04f9a06ee517"
},
{
"description":"SEASHARPEE is a Web shell that has been used by APT34. (Citation: FireEye APT34 Webinar Dec 2017)\n\nAliases: SEASHARPEE",
"description":"Sykipot is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of Sykipot hijacks smart cards on victims. (Citation: Alienvault Sykipot DOD Smart Cards) The group using this malware has also been referred to as Sykipot. (Citation: Blasco 2013)\n\nAliases: Sykipot",
"description":"DownPaper is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citation: ClearSky Charming Kitten Dec 2017)\n\nAliases: DownPaper",
"description":"OSInfo is a custom tool used by APT3 to do internal discovery on a victim's computer and network. (Citation: Symantec Buckeye)\n\nAliases: OSInfo",
"description":"HOMEFRY is a 64-bit Windows password dumper/cracker that has previously been used in conjunction with other Leviathan backdoors. (Citation: FireEye Periscope March 2018)\n\nAliases: HOMEFRY",
"description":"GLOOXMAIL is malware used by APT1 that mimics legitimate Jabber/XMPP traffic. (Citation: Mandiant APT1)\n\nAliases: GLOOXMAIL, Trojan.GTALK",
"description":"Emissary is a Trojan that has been used by Lotus Blossom. It shares code with Elise, with both Trojans being part of a malware group referred to as LStudio. (Citation: Lotus Blossom Dec 2015)\n\nAliases: Emissary",
"description":"PUNCHTRACK is non-persistent point of sale (POS) system malware utilized by FIN8 to scrape payment card data. (Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016)\n\nAliases: PUNCHTRACK, PSVC",
"description":"Miner-C is malware that mines victims for the Monero cryptocurrency. It has targeted FTP servers and Network Attached Storage (NAS) devices to spread. (Citation: Softpedia MinerC)\n\nAliases: Miner-C, Mal/Miner-C, PhotoMiner",
"description":" (Citation: DustySky) is multi-stage malware written in .NET that has been used by Molerats since May 2015. (Citation: DustySky) (Citation: DustySky)2\n\nAliases: (Citation: DustySky), NeD Worm",
"value":"DustySky - S0062",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0062"
],
"external_id":"S0062",
"synonyms":[
"DustySky",
"NeD Worm"
]
},
"uuid":"687c23e4-4e25-4ee7-a870-c5e002511f54"
},
{
"description":"BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities. (Citation: FireEye admin@338)\n\nAliases: BUBBLEWRAP, Backdoor.APT.FakeWinHTTPHelper",
"description":"pngdowner is malware used by Putter Panda. It is a simple tool with limited functionality and no persistence mechanism, suggesting it is used only as a simple \"download-and-\nexecute\" utility. (Citation: CrowdStrike Putter Panda)\n\nAliases: pngdowner",
"description":"Nidiran is a custom backdoor developed and used by Suckfly. It has been delivered via strategic web compromise. (Citation: Symantec Suckfly March 2016)\n\nAliases: Nidiran, Backdoor.Nidiran",
"description":"OwaAuth is a Web shell and credential stealer deployed to Microsoft Exchange servers that appears to be exclusively used by Threat Group-3390. (Citation: Dell TG-3390)\n\nAliases: OwaAuth",
"description":"ROCKBOOT is a Bootkit that has been used by an unidentified, suspected China-based group. (Citation: FireEye Bootkits)\n\nAliases: ROCKBOOT",
"description":"JPIN is a custom-built backdoor family used by PLATINUM. Evidence suggests developers of JPIN and Dipsind code bases were related in some way. (Citation: Microsoft PLATINUM April 2016)\n\nAliases: JPIN\n\nContributors: Ryan Becwar",
"value":"JPIN - S0201",
"meta":{
"refs":[
"https://attack.mitre.org/wiki/Software/S0201"
],
"external_id":"S0201",
"synonyms":[
"JPIN"
]
},
"uuid":"de6cb631-52f6-4169-a73b-7965390b0c30"
},
{
"description":"LOWBALL is malware used by admin@338. It was used in August 2015 in email messages targeting Hong Kong-based media organizations. (Citation: FireEye admin@338)\n\nAliases: LOWBALL",
"description":"is a trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Wiarp May 2012)\n\nAliases: Wiarp",
"description":"BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye APT17) (Citation: FireEye Periscope March 2018)\n\nAliases: BLACKCOFFEE",
"description":"Derusbi is malware used by multiple Chinese APT groups. (Citation: Axiom) (Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed. (Citation: Fidelis Turbo)\n\nAliases: Derusbi, PHOTO",
"description":"RawPOS is a point-of-sale (POS) malware family that searches for cardholder data on victims. It has been in use since at least 2008. (Citation: Kroll RawPOS Jan 2017) (Citation: TrendMicro RawPOS April 2015) (Citation: Visa RawPOS March 2015) FireEye divides RawPOS into three components: FIENDCRY, DUEBREW, and DRIFTWOOD. (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)\n\nAliases: RawPOS, FIENDCRY, DUEBREW, DRIFTWOOD\n\nContributors: Walker Johnson",
"description":"Lurid is a malware family that has been used by several groups, including PittyTiger, in targeted attacks as far back as 2006. (Citation: Villeneuve 2014) (Citation: Villeneuve 2011)\n\nAliases: Lurid, Enfal",
"description":"3PARA RAT is a remote access tool (RAT) programmed in C++ that has been used by Putter Panda. (Citation: CrowdStrike Putter Panda)\n\nAliases: 3PARA RAT",
"description":"JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. (Citation: Kaspersky Sofacy) (Citation: F-Secure Sofacy 2015) (Citation: ESET Sednit Part 1) (Citation: FireEye APT28 January 2017)\n\nAliases: JHUHUGIT, Seduploader, JKEYSKW, Sednit, GAMEFISH, SofacyCarberp",
"description":"ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16. (Citation: FireEye EPS Awakens Part 2)\n\nAliases: ELMER",
