software

PoisonIvy

activeentity:software

[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: poisonivy
kind: software
status: active
aliases: Breut · Darkmoon · Poison Ivy
jurisdictions: —
claims naming it: 0 · 0 attributions · 14 relations · 0 events

Identifiers

attack S0012via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatElderwoodusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_14btcintel:relations:14@v1 sha256:9acbd4e066ef3b46
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatGALLIUMusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_26btcintel:relations:26@v1 sha256:609cd6869c9f13ca
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatadmin@338usesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_57btcintel:relations:57@v1 sha256:157776fd128a9b76
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatmenuPassusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_99btcintel:relations:99@v1 sha256:93ec58b9b8deaf38
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMoafeeusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_148btcintel:relations:148@v1 sha256:2d98f91f9eae6224
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMUSTANG PANDAusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_208btcintel:relations:208@v1 sha256:73b88698f8b5834d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTropic TrooperusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_281btcintel:relations:281@v1 sha256:76916f8e4b140644
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT1usesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_315btcintel:relations:315@v1 sha256:8a882d154775f63e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAxiomusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_457btcintel:relations:457@v1 sha256:d35dcfdc73419358
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT5usesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_516btcintel:relations:516@v1 sha256:1e707500aa27b05b
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMoleratsusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_596btcintel:relations:596@v1 sha256:fa751280eb736e60
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatIndigoZebrausesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_605btcintel:relations:605@v1 sha256:3b68641f04eae583
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatDragonOKusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_623btcintel:relations:623@v1 sha256:992021eba8743921
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatPittyTigerusesPoisonIvy
fetch —sha256 dc1639caa5501d72
rel_670btcintel:relations:670@v1 sha256:2bb40a889a0d500b
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.