Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!
SOFTWARE
Overview 3PARA RAT 4H RAT adbupd Adups ADVSTORESHELL Agent.btz Allwinner Android Overlay Malware Android/Chuli.A ANDROIDOS_ANSERVER.A AndroRAT Arp ASPXSpy at AutoIt backdoor Backdoor.Oldrea BACKSPACE BADCALL BADNEWS Bandook Bankshot BBSRAT BISCUIT Bisonal BITSAdmin BLACKCOFFEE BlackEnergy BOOTRASH BrainTest Brave Prince Briba BS2005 BUBBLEWRAP Cachedump CALENDAR Calisto CallMe Carbanak Catchamas CCBkdr certutil Chaos Charger ChChes Cherry Picker China Chopper CHOPSTICK CloudDuke cmd Cobalt Strike Comnie ComRAT CORALDECK CORESHELL CosmicDuke CozyCar Crimson CrossRAT Daserf DDKONG DealersChoice Dendroid Derusbi Dipsind DOGCALL Dok Downdelph DownPaper DressCode DroidJack dsquery DualToy Duqu DustySky Dyre Elise ELMER Emissary Epic EvilGrab FakeM FALLCHILL Felismus FELIXROOT Fgdump FinFisher Flame FLASHFLOOD FLIPSIDE Forfiles FruitFly FTP Gazer GeminiDuke gh0st GLOOXMAIL Gold Dragon Gooligan GravityRAT gsecdump H1N1 Hacking Team UEFI Rootkit HALFBAKED HAMMERTOSS HAPPYWORK HARDRAIN Havij hcdLoader HDoor Helminth Hi-Zor HIDEDRV Hikit HOMEFRY HTRAN HTTPBrowser httpclient HummingBad HummingWhale Hydraq ifconfig iKitten InnaputRAT InvisiMole Invoke-PSImage ipconfig ISMInjector Ixeshe Janicab JHUHUGIT JPIN jRAT Judy KARAE Kasidet Kazuar Keydnap KEYMARBLE KeyRaider Koadic Komplex KOMPROGO Kwampirs Linfo LOWBALL Lslsass Lurid MacSpy Marcher Matroyshka MazarBOT meek Mimikatz MimiPenguin Miner-C MiniDuke MirageFox Mis-Type Misdat Mivast MobileOrder MoonWind More_eggs Mosquito MURKYTOP Naid NanHaiShu NavRAT nbtstat NDiskMonitor Nerex Net Net Crawler NETEAGLE netsh netstat NetTraveler NETWIRE Nidiran NotCompatible OBAD OLDBAIT OldBoot OnionDuke OopsIE Orz OSInfo OwaAuth P2P ZeuS Pasam Pass-The-Hash Toolkit Pegasus for Android Pegasus for iOS PHOREAL PinchDuke Ping Pisloader PJApps PLAINTEE PlugX pngdowner PoisonIvy POORAIM POSHSPY Power Loader PowerDuke POWERSOURCE PowerSploit POWERSTATS POWRUNER Prikormka Proton Proxysvc PsExec Psylo Pteranodon PUNCHBUGGY PUNCHTRACK Pupy pwdump QUADAGENT QuasarRAT RARSTONE RATANKBA RawPOS RCSAndroid Reaver RedDrop RedLeaves Reg Regin RemoteCMD Remsec Responder RGDoor RIPTIDE ROCKBOOT RogueRobin ROKRAT route Rover RTM RuMMS RunningRAT S-Type Sakula schtasks SDelete SeaDuke SEASHARPEE Shamoon ShiftyBug SHIPSHAPE SHOTPUT SHUTTERSPEED Skeleton Key Skygofree SLOWDRIFT Smoke Loader SNUGRIDE Socksbot SOUNDBITE SPACESHIP spwebmember SpyDealer SpyNote RAT sqlmap SslMM Starloader Stealth Mango StreamEx Sykipot SynAck Sys10 Systeminfo T9000 Taidoor Tangelo Tasklist TDTESS TEXTMATE TINYTYPHON TinyZBot Tor TrickBot Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst.a Trojan-SMS.AndroidOS.OpFake.a Trojan.Karagany Trojan.Mebromi Truvasys TURNEDUP Twitoor TYPEFRAME UACMe Umbreon Unknown Logger UPPERCUT Uroburos USBStealer Vasport VERMIN Volgmer WEBC2 Wiarp Windows Credential Editor WINDSHIELD WINERACK Winexe Wingbird WinMM Winnti Wiper WireLurker X-Agent for Android XAgentOSX Xbot xCmd XcodeGhost XLoader XTunnel YiSpecter yty Zebrocy ZergHelper Zeroaccess ZeroT ZLib
  1. Home
  2. Software
  3. adbupd

adbupd

adbupd is a backdoor used by PLATINUM that is similar to Dipsind. [1]

ID: S0202
Aliases: adbupd
Type: MALWARE
Contributors: Ryan Becwar

Platforms: Windows

Version: 1.0

Alias Descriptions

NameDescription
adbupd[1]

Techniques Used

DomainIDNameUse
EnterpriseT1059Command-Line Interfaceadbupd can run a copy of cmd.exe.[1]
EnterpriseT1032Standard Cryptographic Protocoladbupd contains a copy of the OpenSSL library to encrypt C2 traffic.[1]
EnterpriseT1084Windows Management Instrumentation Event Subscriptionadbupd can use a WMI script to achieve persistence.[1]

Groups

Groups that use this software:

PLATINUM

References

  1. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.