SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)

SHOTPUT is a custom backdoor used by APT3. (Citation: FireEye Clandestine Wolf)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	1
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	Pirpi (4859330d-c6a5-4b9c-b45b-536ec983cd4a)	Tool	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	1
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475)	Attack Pattern	1
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	1
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735)	Attack Pattern	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	2
Pirpi (4859330d-c6a5-4b9c-b45b-536ec983cd4a)	Tool	pirpi (e2325481-006f-4ad4-86d9-1a2ae6fea154)	Malpedia	2