MuddyViper

MuddyViper is custom backdoor written in C and C++ used by MuddyWater for command and control (C2) communications and persistence. MuddyViper is loaded by Fooder and sends frequent messages to the C2 server.

View graph Watch Export

Indicators tracked

Intelligence Reports10

10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

25 relationships

T1053.005: Scheduled Task

source

T1573.001: Symmetric Cryptography

source

T1106: Native API

source

T1140: Deobfuscate/Decode Files or Information

source

T1620: Reflective Code Loading

source

T1560: Archive Collected Data

source

T1112: Modify Registry

source

T1059: Command and Scripting Interpreter

source

T1057: Process Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1059.001: PowerShell

source

T1547.001: Registry Run Keys / Startup Folder

source

T1678: Delay Execution

source

T1056.002: GUI Input Capture

source

T1518.001: Security Software Discovery

source

T1059.003: Windows Command Shell

source

T1071.001: Web Protocols

source

T1105: Ingress Tool Transfer

source