ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > List all tools > List all groups using tool WndTest

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WndTest

TypeBackdoor, Keylogger, Info stealer
Description(Cylance) WndTest is the evolution of the PVZ tool chain into a single executable. The tool chain is minimized down to a command and control communications, keystroke logging, and clipboard monitoring. The command and control still supports upgrading, downloading, and executing of applications, as well as executing batch scripts. WndTest installs as a service and has been observed attempting to impersonate Adobe Report Service. WndTest starts using PHP servers for its command and control server, some of which are listed as defaced sites.

Last change to this tool card: 23 April 2020

Download this tool card in JSON format

All groups using tool WndTest


APT groups

 Cutting Kitten, TG-2889Iran2012-Mar 2016X

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]