The sub-techniques beta is now live! Read the release blog post for more info.
SOFTWARE
SOFTWARE
1-9
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Y-Z
  1. Home
  2. Software
  3. SHOTPUT

SHOTPUT

SHOTPUT is a custom backdoor used by APT3. [1]

ID: S0063
Associated Software: Backdoor.APT.CookieCutter, Pirpi
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 31 May 2017
Last Modified: 17 October 2018

Associated Software Descriptions

Name Description
Backdoor.APT.CookieCutter [3]
Pirpi [3]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1087 Account Discovery

SHOTPUT has a command to retrieve information about connected users.[2]
Enterprise T1083 File and Directory Discovery

SHOTPUT has a command to obtain a directory listing.[2]
Enterprise T1027 Obfuscated Files or Information

SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.[1][2]
Enterprise T1057 Process Discovery

SHOTPUT has a command to obtain a process listing.[2]
Enterprise T1018 Remote System Discovery

SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.[2]
Enterprise T1049 System Network Connections Discovery

SHOTPUT uses netstat to list TCP connection status.[2]

Groups That Use This Software

ID Name References
G0022 APT3 [1]

References

  1. Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.
  2. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  1. Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.