Malware: Pteranodon

Description

[Pteranodon](https://attack.mitre.org/software/S0147) is a custom backdoor used by [Gamaredon Group](https://attack.mitre.org/groups/G0047). (Citation: Palo Alto Gamaredon Feb 2017)

External References

• mitre-attack
• Palo Alto Gamaredon Feb 2017
• Secureworks IRON TILDEN Profile
• Symantec Shuckworm January 2022

Techniques Used by This Malware

• T1027.007 — Dynamic API Resolution
• T1041 — Exfiltration Over C2 Channel
• T1053.005 — Scheduled Task
• T1059.003 — Windows Command Shell
• T1059.005 — Visual Basic
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1074.001 — Local Data Staging
• T1083 — File and Directory Discovery
• T1105 — Ingress Tool Transfer
• T1106 — Native API
• T1113 — Screen Capture
• T1140 — Deobfuscate/Decode Files or Information
• T1218.005 — Mshta
• T1218.011 — Rundll32
• T1497 — Virtualization/Sandbox Evasion
• T1547.001 — Registry Run Keys / Startup Folder

APT Groups Using This Malware

• Gamaredon Group