MITRE ATT&CKsoftware (malware)
S0098 T9000
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2017-05-31
Description
T9000 is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations.
Related
Uses · MITRE ATT&CK (13)
- T1574.001 DLL sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1546.010 AppInit DLLs sub-technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1082 System Information Discovery technique
- T1113 Screen Capture technique
- T1119 Automated Collection technique
- T1120 Peripheral Device Discovery technique
- T1123 Audio Capture technique
- T1124 System Time Discovery technique
- T1125 Video Capture technique
References
- https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html FireEye admin@338 March 2014
- http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/ Palo Alto T9000 Feb 2016