Search/Okrum
● Malware

Okrum

Okrum is a Windows backdoor that has been seen in use since December 2016 with strong links to Ke3chang.

View graph Watch Export
Indicators tracked
0
Intelligence Reports10
10 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
35 relationships
T1053.005: Scheduled Task
source
T1560.001: Archive via Utility
source
T1033: System Owner/User Discovery
source
T1132.001: Standard Encoding
source
T1056.001: Keylogging
source
T1560.003: Archive via Custom Method
source
T1573.001: Symmetric Cryptography
source
T1543.003: Windows Service
source
T1497.001: System Checks
source
T1082: System Information Discovery
source
T1140: Deobfuscate/Decode Files or Information
source
T1547.009: Shortcut Modification
source
T1497.003: Time Based Checks
source
T1003.001: LSASS Memory
source
T1090.002: External Proxy
source
T1003.005: Cached Domain Credentials
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1036.004: Masquerade Task or Service
source
T1049: System Network Connections Discovery
source
T1134.001: Token Impersonation/Theft
source
T1497.002: User Activity Based Checks
source
T1041: Exfiltration Over C2 Channel
source
T1547.001: Registry Run Keys / Startup Folder
source
T1001: Data Obfuscation
source
T1027.003: Steganography
source
T1001.003: Protocol or Service Impersonation
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1071.001: Web Protocols
source
T1105: Ingress Tool Transfer
source
T1564.001: Hidden Files and Directories
source
T1569.002: Service Execution
source
T1124: System Time Discovery
source