Search/metaMain
● Malware

metaMain

metaMain is a backdoor used by Metador to maintain long-term access to compromised machines; it has also been used to decrypt Mafalda into memory.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
29 relationships
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1056.001: Keylogging
source
T1027.013: Encrypted/Encoded File
source
T1560.003: Archive via Custom Method
source
T1074.001: Local Data Staging
source
T1573.001: Symmetric Cryptography
source
T1574.001: DLL
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1055: Process Injection
source
T1070.006: Timestomp
source
T1620: Reflective Code Loading
source
T1497.003: Time Based Checks
source
T1112: Modify Registry
source
T1083: File and Directory Discovery
source
T1205.001: Port Knocking
source
T1057: Process Discovery
source
T1546.003: Windows Management Instrumentation Event Subscription
source
T1041: Exfiltration Over C2 Channel
source
T1056: Input Capture
source
T1095: Non-Application Layer Protocol
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1105: Ingress Tool Transfer
source
T1090.001: Internal Proxy
source