CHOPSTICK
- ID
- S0023
- Type
- Malware
- Associated names
- Backdoor.SofacyX, SPLM, Xagent, X-Agent, webhp
- Platforms
- Windows, Linux
- Source
- attack.mitre.org
- MITRE last modified
- 17 Nov 2024
CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.
Techniques used (19)
- T1008 Fallback Channels
- T1012 Query Registry
- T1027.011 Fileless Storage
- T1056.001 Keylogging
- T1059 Command and Scripting Interpreter
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1083 File and Directory Discovery
- T1090.001 Internal Proxy
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1113 Screen Capture
- T1497 Virtualization/Sandbox Evasion
- T1518.001 Security Software Discovery
- T1568.002 Domain Generation Algorithms
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography