Linfo

Malware & Tools · Linfo

· MalwareS0211 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Linfo is a rootkit trojan used by Elderwood to open a backdoor on compromised hosts. (Citation: Symantec Elderwood Sept 2012) (Citation: Symantec Linfo May 2012)

Tactic Coverage

discovery (3)command and control (2)collection (1)exfiltration (1)execution (1)stealth (1)

Used By (1 groups)

G0066ElderwoodElderwood Gang, Beijing Group

Techniques (9)

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1029Scheduled Transfer

exfiltration

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1082System Information Discovery

References

https://attack.mitre.org/software/S0211 https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99