Skip to content

S0207 Vasport

Vasport is a trojan used by Elderwood to open a backdoor on compromised hosts. 1 2

Item Value
ID S0207
Associated Names
Version 1.1
Created 18 April 2018
Last Modified 06 January 2021
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Vasport creates a backdoor by making a connection using a HTTP POST.2
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder Vasport copies itself to disk and creates an associated run key Registry entry to establish.2
enterprise T1105 Ingress Tool Transfer Vasport can download files.2
enterprise T1090 Proxy Vasport is capable of tunneling though a proxy.2

Groups That Use This Software

ID Name References
G0066 Elderwood 1


Back to top