1. Home
  2. Software
  3. WINERACK

WINERACK

WINERACK is a backdoor used by APT37. [1]

ID: S0219
ⓘ
Type: MALWARE
Version: 1.0
Created: 18 April 2018
Last Modified: 04 September 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 命令与脚本解释器

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.[1]
Enterprise T1010 应用窗口发现

WINERACK can enumerate active windows.[1]
Enterprise T1083 文件和目录发现

WINERACK can enumerate files and directories.[1]
Enterprise T1082 系统信息发现

WINERACK can gather information about the host.[1]
Enterprise T1033 系统所有者/用户发现

WINERACK can gather information on the victim username.[1]
Enterprise T1007 系统服务发现

WINERACK can enumerate services.[1]
Enterprise T1057 进程发现

WINERACK can enumerate processes.[1]

Groups That Use This Software

ID Name References
G0067 APT37

[1]

References

  1. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.