BackConfig — Malware Profile

BackConfig is a custom Trojan with a flexible plugin architecture that has been used by Patchwork.

MITRE ATT&CK techniques (16)

• T1027.010 Command Obfuscation
• T1036.005 Match Legitimate Resource Name or Location
• T1053.005 Scheduled Task
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1137.001 Office Template Macros
• T1140 Deobfuscate/Decode Files or Information
• T1204.001 Malicious Link
• T1553.002 Code Signing
• T1564.001 Hidden Files and Directories

Attributed threat actors

• Patchwork

Read the full analysis on IntelFusions