TEXTMATE

Malware & Tools · TEXTMATE

· MalwareS0146 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017. (Citation: FireEye FIN7 March 2017)

Tactic Coverage

execution (1)command and control (1)

Used By (1 groups)

G0046FIN7GOLD NIAGARA, ITG14

Techniques (2)

T1059.003Windows Command Shell

execution

T1071.004DNS

command and control

References

https://attack.mitre.org/software/S0146 http://blog.talosintelligence.com/2017/03/dnsmessenger.html https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html