ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool WndTest

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WndTest

NamesWndTest
CategoryMalware
TypeBackdoor, Keylogger, Info stealer
Description(Cylance) WndTest is the evolution of the PVZ tool chain into a single executable. The tool chain is minimized down to a command and control communications, keystroke logging, and clipboard monitoring. The command and control still supports upgrading, downloading, and executing of applications, as well as executing batch scripts. WndTest installs as a service and has been observed attempting to impersonate Adobe Report Service. WndTest starts using PHP servers for its command and control server, some of which are listed as defaced sites.
Information<https://www.cylance.com/content/dam/cylance/pdfs/reports/Cylance_Operation_Cleaver_Report.pdf>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.wndtest>

Last change to this tool card: 23 April 2020

Download this tool card in JSON format

Previous: WMI Ghost
Next: WolfRAT

All groups using tool WndTest

ChangedNameCountryObserved

APT groups

 Cutting Kitten, TG-2889Iran2012-Mar 2016X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key