● Malware

AshTag

AshTag is a modular .NET backdoor with multiple features that has been used by WIRTE since at least 2025. AshTag is designed for persistence and remote command execution and can masquerade as a legitimate VisualServer utility.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

24 relationships

T1053.005: Scheduled Task

source

T1047: Windows Management Instrumentation

source

T1113: Screen Capture

source

T1027.013: Encrypted/Encoded File

source

T1059.007: JavaScript

source

T1036.005: Match Legitimate Resource Name or Location

source

T1204.002: Malicious File

source

T1574.001: DLL

source

T1082: System Information Discovery

source

T1140: Deobfuscate/Decode Files or Information

source

T1083: File and Directory Discovery

source

T1102: Web Service

source

T1057: Process Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1678: Delay Execution

source

T1614: System Location Discovery

source

T1071.001: Web Protocols

source

T1105: Ingress Tool Transfer

source

T1680: Local Storage Discovery

source