Check out the results from our first round of ATT&CK Evaluations at attackevals.mitre.org!
SOFTWARE
Overview 3PARA RAT 4H RAT adbupd Adups ADVSTORESHELL Agent.btz Allwinner Android Overlay Malware Android/Chuli.A ANDROIDOS_ANSERVER.A AndroRAT Arp ASPXSpy at AutoIt backdoor Backdoor.Oldrea BACKSPACE BADCALL BADNEWS Bandook Bankshot BBSRAT BISCUIT Bisonal BITSAdmin BLACKCOFFEE BlackEnergy BOOTRASH BrainTest Brave Prince Briba BS2005 BUBBLEWRAP Cachedump CALENDAR Calisto CallMe Carbanak Catchamas CCBkdr certutil Chaos Charger ChChes Cherry Picker China Chopper CHOPSTICK CloudDuke cmd Cobalt Strike Comnie ComRAT CORALDECK CORESHELL CosmicDuke CozyCar Crimson CrossRAT Daserf DDKONG DealersChoice Dendroid Derusbi Dipsind DOGCALL Dok Downdelph DownPaper DressCode DroidJack dsquery DualToy Duqu DustySky Dyre Elise ELMER Emissary Epic EvilGrab FakeM FALLCHILL Felismus FELIXROOT Fgdump FinFisher Flame FLASHFLOOD FLIPSIDE Forfiles FruitFly FTP Gazer GeminiDuke gh0st GLOOXMAIL Gold Dragon Gooligan GravityRAT gsecdump H1N1 Hacking Team UEFI Rootkit HALFBAKED HAMMERTOSS HAPPYWORK HARDRAIN Havij hcdLoader HDoor Helminth Hi-Zor HIDEDRV Hikit HOMEFRY HTRAN HTTPBrowser httpclient HummingBad HummingWhale Hydraq ifconfig iKitten InnaputRAT InvisiMole Invoke-PSImage ipconfig ISMInjector Ixeshe Janicab JHUHUGIT JPIN jRAT Judy KARAE Kasidet Kazuar Keydnap KEYMARBLE KeyRaider Koadic Komplex KOMPROGO Kwampirs Linfo LOWBALL Lslsass Lurid MacSpy Marcher Matroyshka MazarBOT meek Mimikatz MimiPenguin Miner-C MiniDuke MirageFox Mis-Type Misdat Mivast MobileOrder MoonWind More_eggs Mosquito MURKYTOP Naid NanHaiShu NavRAT nbtstat NDiskMonitor Nerex Net Net Crawler NETEAGLE netsh netstat NetTraveler NETWIRE Nidiran NotCompatible OBAD OLDBAIT OldBoot OnionDuke OopsIE Orz OSInfo OwaAuth P2P ZeuS Pasam Pass-The-Hash Toolkit Pegasus for Android Pegasus for iOS PHOREAL PinchDuke Ping Pisloader PJApps PLAINTEE PlugX pngdowner PoisonIvy POORAIM POSHSPY Power Loader PowerDuke POWERSOURCE PowerSploit POWERSTATS POWRUNER Prikormka Proton Proxysvc PsExec Psylo Pteranodon PUNCHBUGGY PUNCHTRACK Pupy pwdump QUADAGENT QuasarRAT RARSTONE RATANKBA RawPOS RCSAndroid Reaver RedDrop RedLeaves Reg Regin RemoteCMD Remsec Responder RGDoor RIPTIDE ROCKBOOT RogueRobin ROKRAT route Rover RTM RuMMS RunningRAT S-Type Sakula schtasks SDelete SeaDuke SEASHARPEE Shamoon ShiftyBug SHIPSHAPE SHOTPUT SHUTTERSPEED Skeleton Key Skygofree SLOWDRIFT Smoke Loader SNUGRIDE Socksbot SOUNDBITE SPACESHIP spwebmember SpyDealer SpyNote RAT sqlmap SslMM Starloader Stealth Mango StreamEx Sykipot SynAck Sys10 Systeminfo T9000 Taidoor Tangelo Tasklist TDTESS TEXTMATE TINYTYPHON TinyZBot Tor TrickBot Trojan-SMS.AndroidOS.Agent.ao Trojan-SMS.AndroidOS.FakeInst.a Trojan-SMS.AndroidOS.OpFake.a Trojan.Karagany Trojan.Mebromi Truvasys TURNEDUP Twitoor TYPEFRAME UACMe Umbreon Unknown Logger UPPERCUT Uroburos USBStealer Vasport VERMIN Volgmer WEBC2 Wiarp Windows Credential Editor WINDSHIELD WINERACK Winexe Wingbird WinMM Winnti Wiper WireLurker X-Agent for Android XAgentOSX Xbot xCmd XcodeGhost XLoader XTunnel YiSpecter yty Zebrocy ZergHelper Zeroaccess ZeroT ZLib
  1. Home
  2. Software
  3. SLOWDRIFT

SLOWDRIFT

SLOWDRIFT is a backdoor used by APT37 against academic and strategic victims in South Korea. [1]

ID: S0218
Aliases: SLOWDRIFT
Type: MALWARE
Platforms: Windows

Version: 1.0

Alias Descriptions

NameDescription
SLOWDRIFT[1]

Techniques Used

DomainIDNameUse
EnterpriseT1105Remote File CopySLOWDRIFT downloads additional payloads.[1]
EnterpriseT1082System Information DiscoverySLOWDRIFT collects and sends system information to its C2.[1]
EnterpriseT1102Web ServiceSLOWDRIFT uses cloud based services for C2.[1]

Groups

Groups that use this software:

APT37

References

  1. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.