Description
[Heyoka Backdoor](https://attack.mitre.org/software/S1027) is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by [Aoqin Dragon](https://attack.mitre.org/groups/G1007) since at least 2013.(Citation: SentinelOne Aoqin Dragon June 2022)(Citation: Sourceforge Heyoka 2022)
External References
Techniques Used by This Malware
- T1007 — System Service Discovery
- T1027.013 — Encrypted/Encoded File
- T1036.004 — Masquerade Task or Service
- T1055.001 — Dynamic-link Library Injection
- T1057 — Process Discovery
- T1070.004 — File Deletion
- T1071.004 — DNS
- T1082 — System Information Discovery
- T1083 — File and Directory Discovery
- T1120 — Peripheral Device Discovery
- T1140 — Deobfuscate/Decode Files or Information
- T1204.002 — Malicious File
- T1218.011 — Rundll32
- T1547.001 — Registry Run Keys / Startup Folder
- T1572 — Protocol Tunneling