S0206 Wiarp

Wiarp is a trojan used by Elderwood to open a backdoor on compromised hosts. ¹ ²

Techniques Used

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	Wiarp creates a backdoor through which remote attackers can open a command line interface.²
enterprise	T1543	Create or Modify System Process	-
enterprise	T1543.003	Windows Service	Wiarp creates a backdoor through which remote attackers can create a service.²
enterprise	T1105	Ingress Tool Transfer	Wiarp creates a backdoor through which remote attackers can download files.²
enterprise	T1055	Process Injection	Wiarp creates a backdoor through which remote attackers can inject files into running processes.²

ID	Name	References
G0066	Elderwood	¹