Vasport

Vasport is a trojan used by Elderwood to open a backdoor on compromised hosts. [1] [2]

ID: S0207
Aliases: Vasport
Type: MALWARE
Platforms: Windows

Version: 1.0

Alias Descriptions

NameDescription
Vasport[2]

Techniques Used

DomainIDNameUse
EnterpriseT1090Connection ProxyVasport is capable of tunneling though a proxy.[2]
EnterpriseT1060Registry Run Keys / Startup FolderVasport copies itself to disk and creates an associated run key Registry entry to establish.[2]
EnterpriseT1105Remote File CopyVasport can download files.[2]
EnterpriseT1071Standard Application Layer ProtocolVasport creates a backdoor by making a connection using a HTTP POST.[2]

Groups

Groups that use this software:

Elderwood

References