Skip to content

Hide Navigation Hide TOC

WINERACK (49025073-4cd3-43b8-b893-e80a1d3adc04)

WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.

Cluster A Galaxy A Cluster B Galaxy B Level
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware WINERACK (49025073-4cd3-43b8-b893-e80a1d3adc04) Tool 1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) Attack Pattern WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) Attack Pattern 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa) Attack Pattern 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) Attack Pattern 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104) Attack Pattern 2
WINERACK - S0219 (49abab73-3c5c-476e-afd5-69b5c732d845) Malware Application Window Discovery - T1010 (4ae4f953-fe58-4cc8-a327-33257e30a830) Attack Pattern 2