MITRE ATT&CKsoftware (malware)

S0439 Okrum

Published 2020-05-06 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2020-05-06

Description

Okrum is a Windows backdoor that has been seen in use since December 2016 with strong links to Ke3chang.

Related

Uses · MITRE ATT&CK (34)

  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1090.002 External Proxy sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1497.001 System Checks sub-technique
  • T1497.002 User Activity Based Checks sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1056.001 Keylogging sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1027.003 Steganography sub-technique
  • T1070.004 File Deletion sub-technique
  • T1547.009 Shortcut Modification sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1001 Data Obfuscation technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1049 System Network Connections Discovery technique
Show all 34 ›

Referenced by MITRE ATT&CK · uses (1)

References