MITRE ATT&CKsoftware (malware)

S0146 TEXTMATE

Published 2017-05-31 Modified 2025-04-16 Official page ↗

Domain: enterprise
Platforms: Windows
Aliases: DNSMessenger
Version: 1.1
Created: 2017-05-31

Description

TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017.

Related

Uses · MITRE ATT&CK (2)

T1071.004 DNS sub-technique
T1059.003 Windows Command Shell sub-technique

Referenced by MITRE ATT&CK · uses (1)

G0046 FIN7 group

References

http://blog.talosintelligence.com/2017/03/dnsmessenger.html Cisco DNSMessenger March 2017
https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html FireEye FIN7 March 2017