BUBBLEWRAP - S0043 (123bd7b3-675c-4b1a-8482-c55782b20e2b)

BUBBLEWRAP is a full-featured, second-stage backdoor used by the admin@338 group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities. (Citation: FireEye admin@338)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	BUBBLEWRAP - S0043 (123bd7b3-675c-4b1a-8482-c55782b20e2b)	Malware	1
BUBBLEWRAP - S0043 (123bd7b3-675c-4b1a-8482-c55782b20e2b)	Malware	Non-Application Layer Protocol - T1095 (c21d5a77-d422-4a69-acd7-2c53c1faa34b)	Attack Pattern	1
BUBBLEWRAP - S0043 (123bd7b3-675c-4b1a-8482-c55782b20e2b)	Malware	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	1
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	2