POORAIM
Description
(FireEye) POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM.
POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014.
Compromised sites have acted as watering holes to deliver newer variants of POORAIM.
Names
| Name |
|---|
| POORAIM |
| Backdoor.APT.POORAIM |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Info stealer
- Exfiltration
Information
Mitre Attack
Other Information
Uuid
3e017ae6-9f5a-4c0b-8720-e567567c51e3
Last Card Change
2020-04-22