Home > List all groups > List all tools > List all groups using tool VIDEOKILLER

Threat Group Cards: A Threat Actor Encyclopedia

Names	VIDEOKILLER
Category	Malware
Type	Backdoor
Description	(FireEye) VIDEOKILLER is a .NET backdoor similar to RADIOSTAR that handles commands from the C&C server. It masquerades as conhost.exe. The majority of strings it contains are Base64 encoded, though some are not, such as the string “It’s Ok” which is potentially used for logging throughout execution.
Information	<https://content.fireeye.com/web-assets/rpt-unc1151-ghostwriter-update>

Last change to this tool card: 15 May 2021

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups