Skip to content

Hide Navigation Hide TOC

ELMER - S0064 (3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c)

ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16. (Citation: FireEye EPS Awakens Part 2)

Cluster A Galaxy A Cluster B Galaxy B Level
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern ELMER - S0064 (3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c) Malware 1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern ELMER - S0064 (3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c) Malware 1
ELMER - S0064 (3cab1b76-2f40-4cd0-8d2c-7ed16eeb909c) Malware Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 1
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 2