Searching
..

Click anywhere to stop

Trojan.Win32.SuperThreat.i

Class Trojan
Platform Win32
Family SuperThreat
Full name Trojan.Win32.SuperThreat.i
Examples 8D244A76B398A6B121E465A2CF67A59B
3D640F47E3E5845243F9132C36ABEB5B
5C36C1F64027CDE6D5C7C77E74DC5F26
A733EC0FCFEA5269B9533ACC2DADE87A
15E850AEDF3D45636F99DB0D73E0ED1F
Updated at 2024-01-12 12:36:07
Tactics &
techniques MITRE*

TA0011 Command and Control

The adversary is trying to communicate with compromised systems to control them.


Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.


T1095 Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

ICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.
* © 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Find out the statistics of the threats spreading in your region