ELMER

S0064

About this malware

ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16.

Technique	Procedure example
T1057 Process Discovery	ELMER is capable of performing process listings. FireEye EPS Awakens Part 2
T1071.001 Web Protocols	ELMER uses HTTP for command and control. FireEye EPS Awakens Part 2
T1083 File and Directory Discovery	ELMER is capable of performing directory listings. FireEye EPS Awakens Part 2

None recorded.

FireEye EPS Awakens Part 2 Open source
Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.