Register to stream ATT&CKcon 2.0 October 29-30

SHOTPUT

SHOTPUT is a custom backdoor used by APT3. [1]

ID: S0063
Associated Software: Backdoor.APT.CookieCutter, Pirpi
Type: MALWARE
Platforms: Windows
Version: 1.0

Associated Software Descriptions

Name Description
Backdoor.APT.CookieCutter [3]
Pirpi [3]

Techniques Used

Domain ID Name Use
Enterprise T1087 Account Discovery SHOTPUT has a command to retrieve information about connected users. [2]
Enterprise T1083 File and Directory Discovery SHOTPUT has a command to obtain a directory listing. [2]
Enterprise T1027 Obfuscated Files or Information SHOTPUT is obscured using XOR encoding and appended to a valid GIF file. [1] [2]
Enterprise T1057 Process Discovery SHOTPUT has a command to obtain a process listing. [2]
Enterprise T1018 Remote System Discovery SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain. [2]
Enterprise T1049 System Network Connections Discovery SHOTPUT uses netstat to list TCP connection status. [2]

Groups That Use This Software

ID Name References
G0022 APT3 [1]

References