Malware: BackConfig

Description

[BackConfig](https://attack.mitre.org/software/S0475) is a custom Trojan with a flexible plugin architecture that has been used by [Patchwork](https://attack.mitre.org/groups/G0040).(Citation: Unit 42 BackConfig May 2020)

External References

• mitre-attack
• Unit 42 BackConfig May 2020

Techniques Used by This Malware

• T1027.010 — Command Obfuscation
• T1036.005 — Match Legitimate Resource Name or Location
• T1053.005 — Scheduled Task
• T1059.003 — Windows Command Shell
• T1059.005 — Visual Basic
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1105 — Ingress Tool Transfer
• T1106 — Native API
• T1137.001 — Office Template Macros
• T1140 — Deobfuscate/Decode Files or Information
• T1204.001 — Malicious Link
• T1553.002 — Code Signing
• T1564.001 — Hidden Files and Directories

APT Groups Using This Malware

• Patchwork