SupperMalware
- socksshell
- zapcat
Supper is a 64-bit Windows backdoor and tunnelling utility first observed in the wild in July 2024. This malware operates as both a Remote Access Trojan (RAT) and a SOCKS5 proxy, offering threat actors persistent access to infected systems and the ability to route arbitrary traffic through victim environments. Once executed, it establishes a TCP connection to its primary C2 endpoint, i.e.From MISP Galaxy
Last reported 11 months ago, by Huntress1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
- T1021.006Windows Remote Management
“…and 54 minutes after the initial JavaScript execution and reconnaissance activity, the threat actor moved laterally via WinRM (Windows Remote Management) to the Domain Controller.”
- T1053.005Scheduled Task
“Moved from scheduled tasks to Startup folder persistence mechanism and still using Windows 8.3 short filenames”
- T1547.001Registry Run Keys / Startup Folder
“…the initial JavaScript file, approximately 10-20 minutes later, two persistence mechanisms would be created leveraging Startup folder (T1547.001).”
- T1558.003Kerberoasting
“… infection, with Domain Controller compromise achieved in as little as 17 hours through predictable attack patterns: AD enumeration (Kerberoasting, SPN scanning), lateral movement via WinRM, Domain Admin account creation, and potential ransomware preparation (Volume Shadow Copy e…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Gootloader | Threat Detection Overview“Supper SOCKS5 Backdoor—Vanilla Tempest's Tool of Choice contains extensive obfuscation: API hammering, runtime shellcode construction, API hashing, and custom 2-byte LZMA compression”
Indicators in its reports
named in the reports above- cf44aa11a17b3dad…c9d3d183482ain 1 report
- 103.253.42[.]91in 1 report
- 91.236.230[.]134in 1 report
- 213.232.236[.]138in 1 report
- 146.19.49[.]177in 1 report
- 39d980851be1e111…5435c78f7049in 1 report
- hxxps://cortinaspraga[.]com/in 1 report
- cortinaspraga[.]comin 1 report
- hxxp://cookcountyjudges[.]org/in 1 report
- cookcountyjudges[.]orgin 1 report
- hxxps://x.fybw[.]org/in 1 report
- x.fybw[.]orgin 1 report
- hxxps://jungutah[.]com/in 1 report
- jungutah[.]comin 1 report
- hxxps://influenceimmo[.]com/in 1 report
- influenceimmo[.]comin 1 report
- hxxps://tokyocheapo[.]com/in 1 report
- tokyocheapo[.]comin 1 report
- hxxps://espressonisten[.]de/in 1 report
- espressonisten[.]dein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.