POORAIM

POORAIM is a backdoor used by APT37 in campaigns since at least 2014. ^[1]

ID: S0216

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 1.1

Created: 18 April 2018

Last Modified: 30 March 2020

Techniques Used

Domain	ID		Name	Use
Enterprise	T1113		屏幕捕获	POORAIM can perform screen capturing.^[1]
Enterprise	T1083		文件和目录发现	POORAIM can conduct file browsing.^[1]
Enterprise	T1189		浏览器攻击	POORAIM has been delivered through compromised sites acting as watering holes.^[1]
Enterprise	T1082		系统信息发现	POORAIM can identify system information, including battery status.^[1]
Enterprise	T1102	.002	网络服务: Bidirectional Communication	POORAIM has used AOL Instant Messenger for C2.^[1]
Enterprise	T1057		进程发现	POORAIM can enumerate processes.^[1]

ID	Name	References
G0067	APT37	^[1]