SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
SHOTPUT
ID: S0063
Associated Software: Backdoor.APT.CookieCutter, Pirpi
Type: MALWARE
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 30 March 2020
Associated Software Descriptions
Name | Description |
---|---|
Backdoor.APT.CookieCutter | |
Pirpi |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1087 | .001 | Account Discovery: Local Account |
SHOTPUT has a command to retrieve information about connected users.[3] |
Enterprise | T1083 | File and Directory Discovery | ||
Enterprise | T1027 | Obfuscated Files or Information |
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.[1][3] |
|
Enterprise | T1057 | Process Discovery | ||
Enterprise | T1018 | Remote System Discovery |
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.[3] |
|
Enterprise | T1049 | System Network Connections Discovery |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0022 | APT3 |
References
×