Malware: PHOREAL

Description

[PHOREAL](https://attack.mitre.org/software/S0158) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050). (Citation: FireEye APT32 May 2017)

External References

• mitre-attack
• FireEye APT32 May 2017

Techniques Used by This Malware

• T1059.003 — Windows Command Shell
• T1095 — Non-Application Layer Protocol
• T1112 — Modify Registry

APT Groups Using This Malware

• APT32