MITRE ATT&CKsoftware (malware)

S0141 Winnti for Windows

Published 2017-05-31 Modified 2024-04-10 Official page ↗
Domain
enterprise
Platforms
Windows
Version
3.1
Created
2017-05-31

Description

Winnti for Windows is a modular remote access Trojan (RAT) that has been used likely by multiple groups to carry out intrusions in various regions since at least 2010, including by one group referred to as the same name, Winnti Group.. The Linux variant is tracked separately under Winnti for Linux.

Related

Uses · MITRE ATT&CK (22)

  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1480.001 Environmental Keying sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1090.001 Internal Proxy sub-technique
  • T1090.002 External Proxy sub-technique
  • T1569.002 Service Execution sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1548.002 Bypass User Account Control sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (2)

  • G0143 Aquatic Panda group
  • G0044 Winnti Group group

References