CHOPSTICK — Malware Profile
CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. It is tracked separately from the X-Agent for Android.
MITRE ATT&CK techniques (19)
- T1008 Fallback Channels
- T1012 Query Registry
- T1027.011 Fileless Storage
- T1056.001 Keylogging
- T1059 Command and Scripting Interpreter
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1083 File and Directory Discovery
- T1090.001 Internal Proxy
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1113 Screen Capture
- T1497 Virtualization/Sandbox Evasion
- T1518.001 Security Software Discovery
- T1568.002 Domain Generation Algorithms
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography