MITRE ATT&CKsoftware (malware)
S0023 CHOPSTICK
- Domain
- enterprise
- Platforms
- Windows, Linux
- Aliases
- Backdoor.SofacyX, SPLM, Xagent, X-Agent, webhp
- Version
- 2.3
- Created
- 2017-05-31
Description
CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. It is tracked separately from the X-Agent for Android.
Related
Uses · MITRE ATT&CK (19)
- T1027.011 Fileless Storage sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.003 Mail Protocols sub-technique
- T1090.001 Internal Proxy sub-technique
- T1568.002 Domain Generation Algorithms sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1056.001 Keylogging sub-technique
- T1497 Virtualization/Sandbox Evasion technique
- T1008 Fallback Channels technique
- T1012 Query Registry technique
- T1059 Command and Scripting Interpreter technique
- T1083 File and Directory Discovery technique
- T1091 Replication Through Removable Media technique
- T1092 Communication Through Removable Media technique
- T1105 Ingress Tool Transfer technique
- T1112 Modify Registry technique
- T1113 Screen Capture technique
Referenced by MITRE ATT&CK · uses (1)
- G0007 APT28 group
References
- http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf ESET Sednit Part 2
- https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf FireEye APT28 January 2017
- https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf FireEye APT28
- https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf DOJ GRU Indictment Jul 2018
- https://www.symantec.com/blogs/election-security/apt28-espionage-military-government Symantec APT28 Oct 2018