Pirpi (4859330d-c6a5-4b9c-b45b-536ec983cd4a)

Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	Pirpi (4859330d-c6a5-4b9c-b45b-536ec983cd4a)	Tool	1
Pirpi (4859330d-c6a5-4b9c-b45b-536ec983cd4a)	Tool	pirpi (e2325481-006f-4ad4-86d9-1a2ae6fea154)	Malpedia	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	2
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	2
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475)	Attack Pattern	2
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	2
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	2
SHOTPUT - S0063 (58adaaa8-f1e8-4606-9a08-422e568461eb)	Malware	Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735)	Attack Pattern	2
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	3