Search/Attor
● Malware

Attor

Attor is a Windows-based espionage platform that has been seen in use since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets.

View graph Watch Export
Indicators tracked
3
View 3 indicators
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
38 relationships
T1053.005: Scheduled Task
source
T1113: Screen Capture
source
T1218.011: Rundll32
source
T1056.001: Keylogging
source
T1129: Shared Modules
source
T1027.013: Encrypted/Encoded File
source
T1123: Audio Capture
source
T1560.003: Archive via Custom Method
source
T1074.001: Local Data Staging
source
T1573.001: Symmetric Cryptography
source
T1543.003: Windows Service
source
T1497.001: System Checks
source
T1119: Automated Collection
source
T1115: Clipboard Data
source
T1120: Peripheral Device Discovery
source
T1106: Native API
source
T1055: Process Injection
source
T1070.006: Timestomp
source
T1010: Application Window Discovery
source
T1112: Modify Registry
source
T1020: Automated Exfiltration
source
T1083: File and Directory Discovery
source
T1036.004: Masquerade Task or Service
source
T1055.004: Asynchronous Procedure Call
source
T1041: Exfiltration Over C2 Channel
source
T1071.002: File Transfer Protocols
source
T1090.003: Multi-hop Proxy
source
T1573.002: Asymmetric Cryptography
source
T1012: Query Registry
source
T1070.004: File Deletion
source
T1105: Ingress Tool Transfer
source
T1037.001: Logon Script (Windows)
source
T1564.001: Hidden Files and Directories
source
T1569.002: Service Execution
source
T1680: Local Storage Discovery
source