ctrlINT What the industry said about every indicator, with the quote

FDMTPMalware

FDMTP is a newly discovered hacking tool developed in. NET, used by Earth Preta. It functions as a simple malware downloader and is based on the TouchSocket framework over the Duplex Message Transport Protocol (DMTP). In one campaign, threat actors embedded FDMTP in the data section of a DLL. This allows it to be launched through DLL side-loading.From MISP Galaxy

Last reported 2 months ago, by Fortinet Threat Research1 report

ATT&CK techniques

6 of 10 · each with the sentence it comes from
  1. T1036Masquerading

    “T1036.005Masquerading: Match Legitimate Resource Name or LocationInitial domains employed during initial loader components attempt to masquerade as legitimate QuickFox infrastructure.”

    Fortinet Threat ResearchVendor
  2. T1059Command and Scripting Interpreter

    “T1059.007 Command and Scripting Interpreter: JavaScriptObfuscated JavaScript running in the context of QuickFox Electron application used across multiple stages of infection.”

    Fortinet Threat ResearchVendor
  3. T1059.007JavaScript

    “T1059.007 Command and Scripting Interpreter: JavaScriptObfuscated JavaScript running in the context of QuickFox Electron application used across multiple stages of infection.”

    Fortinet Threat ResearchVendor
  4. T1071.001Web Protocols

    “T1071.001 Application Layer Protocol: Web Protocols  C2 communications are initially through web requests to malicious domains.”

    Fortinet Threat ResearchVendor
  5. T1104Multi-Stage Channels

    “T1104  Multi-Stage ChannelsInitial C2 used by loaders and to register targets with C2 is web protocol based, but FDMTP implant communicates via TouchSocket Duplex Message Transport Protocol (FDMTP) to ‘cluster’ IPs retrieved during registration.”

    Fortinet Threat ResearchVendor
  6. T1195Supply Chain Compromise

    “T1195.002Supply Chain Compromise: Compromise Software Supply ChainQuickFox application compromised through the introduction of malicious JavaScript within embedded Electron renderer HTML file bundled into legitimate QuickFox application.”

    Fortinet Threat ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “QuickFox Supply Chain Attack Used to Deploy FDMTP Implant”

    Fortinet Threat ResearchVendor
    QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with FDMTP here?
No account needed. We do not store your IP address.