Skip to content

Hide Navigation Hide TOC

DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68)

DoubleAgent is a family of RAT malware dating back to 2013, known to target groups with contentious relationships with the Chinese government.(Citation: Lookout Uyghur Campaign)

Cluster A Galaxy A Cluster B Galaxy B Level
Stored Application Data - T1409 (702055ac-4e54-4ae9-9527-e23a38e0b160) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Software Discovery - T1418 (198ce408-1470-45ee-b47f-7056050d4fc2) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
System Information Discovery - T1426 (e2ea7f6b-8d4f-49c3-819d-660530d12b77) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Compromise Client Software Binary - T1645 (4f14e30b-8b57-4a7b-9093-2c0778ea99cf) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Download New Code at Runtime - T1407 (6c49d50f-494d-4150-b774-a655022d20a6) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Suppress Application Icon - T1628.001 (f05fc151-aa62-47e3-ae57-2d1b23d64bf6) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Call Log - T1636.002 (1d1b1558-c833-482e-aabb-d07ef6eae63d) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Audio Capture - T1429 (6683aa0c-d98a-4f5b-ac57-ca7e9934a760) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
File and Directory Discovery - T1420 (cf28ca46-1fd3-46b4-b1f6-ec0b72361848) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Application Layer Protocol - T1437 (6a3f6490-9c44-40de-b059-e5940f246673) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Unix Shell - T1623.001 (693cdbff-ea73-49c6-ac3f-91e7285c31d1) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Contact List - T1636.003 (e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
File Deletion - T1630.002 (ab7400b7-3476-4776-9545-ef3fa373de63) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Exploitation for Privilege Escalation - T1404 (351c0927-2fc1-4a2c-ad84-cbbee7eb8172) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Data from Local System - T1533 (e1c912a9-e305-434b-9172-8a6ce3ec9c4a) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Match Legitimate Name or Location - T1655.001 (114fed8b-7eed-4136-8b9c-411c5c7fff4b) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Obfuscated Files or Information - T1406 (d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a) Attack Pattern DoubleAgent - S0550 (3d6c4389-3489-40a3-beda-c56e650b6f68) Malware 1
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e) Attack Pattern SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002) Attack Pattern 2
Suppress Application Icon - T1628.001 (f05fc151-aa62-47e3-ae57-2d1b23d64bf6) Attack Pattern Hide Artifacts - T1628 (fc53309d-ebd5-4573-9242-57024ebdad4f) Attack Pattern 2
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e) Attack Pattern Call Log - T1636.002 (1d1b1558-c833-482e-aabb-d07ef6eae63d) Attack Pattern 2
Command and Scripting Interpreter - T1623 (29f1f56c-7b7a-4c14-9e39-59577ea2743c) Attack Pattern Unix Shell - T1623.001 (693cdbff-ea73-49c6-ac3f-91e7285c31d1) Attack Pattern 2
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e) Attack Pattern Contact List - T1636.003 (e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86) Attack Pattern 2
Indicator Removal on Host - T1630 (0d4e3bbb-7af5-4c88-a215-0c0906bc1e8d) Attack Pattern File Deletion - T1630.002 (ab7400b7-3476-4776-9545-ef3fa373de63) Attack Pattern 2
Masquerading - T1655 (f856eaab-e84a-4265-a8a2-7bf37e5dc2fc) Attack Pattern Match Legitimate Name or Location - T1655.001 (114fed8b-7eed-4136-8b9c-411c5c7fff4b) Attack Pattern 2