Attor

ATP Sandbox Adv. Heuristics

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

35 techniques across 8 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1106Native API
T1129Shared Modules
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1037Boot or Logon Initialization Scripts
- T1037.001Logon Script (Windows)
T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.004Masquerade Task or Service
T1055Process Injection
- T1055.004Asynchronous Procedure Call
T1070Indicator Removal
- T1070.006Timestomp
- T1070.004File Deletion
T1218System Binary Proxy Execution
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0007 Discovery

T1010Application Window Discovery
T1012Query Registry
T1083File and Directory Discovery
T1120Peripheral Device Discovery
T1680Local Storage Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1074Data Staged
- T1074.001Local Data Staging
T1113Screen Capture
T1115Clipboard Data
T1119Automated Collection
T1123Audio Capture
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.002File Transfer Protocols
T1090Proxy
- T1090.003Multi-hop Proxy
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1020Automated Exfiltration
T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

T1112Modify Registry

Alert name variants

Alert Name	Engine
Win32.Trojan.Attor	ATP Sandbox Adv. Heuristics

Related families

InvisiMole Machete PlugX QakBot Cobalt Strike