S0211 Linfo

Linfo is a rootkit trojan used by Elderwood to open a backdoor on compromised hosts. ¹ ²

Techniques Used

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	Linfo creates a backdoor through which remote attackers can start a remote shell.²
enterprise	T1005	Data from Local System	Linfo creates a backdoor through which remote attackers can obtain data from local systems.²
enterprise	T1008	Fallback Channels	Linfo creates a backdoor through which remote attackers can change C2 servers.²
enterprise	T1083	File and Directory Discovery	Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.²
enterprise	T1070	Indicator Removal	-
enterprise	T1070.004	File Deletion	Linfo creates a backdoor through which remote attackers can delete files.²
enterprise	T1105	Ingress Tool Transfer	Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.²
enterprise	T1057	Process Discovery	Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.²
enterprise	T1029	Scheduled Transfer	Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.²
enterprise	T1082	System Information Discovery	Linfo creates a backdoor through which remote attackers can retrieve system information.²

ID	Name	References
G0066	Elderwood	¹