TEXTMATE — Malware Profile

TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along with POWERSOURCE in February 2017.

MITRE ATT&CK techniques (2)

• T1059.003 Windows Command Shell
• T1071.004 DNS

Attributed threat actors

• FIN7

Read the full analysis on IntelFusions