Malware: SHOTPUT

Description

[SHOTPUT](https://attack.mitre.org/software/S0063) is a custom backdoor used by [APT3](https://attack.mitre.org/groups/G0022). (Citation: FireEye Clandestine Wolf)

External References

• mitre-attack
• FireEye Clandestine Wolf
• FireEye Clandestine Fox Part 2

Techniques Used by This Malware

• T1018 — Remote System Discovery
• T1027 — Obfuscated Files or Information
• T1049 — System Network Connections Discovery
• T1057 — Process Discovery
• T1083 — File and Directory Discovery
• T1087.001 — Local Account

APT Groups Using This Malware

• APT3