BackConfig

ATP Sandbox Adv. Heuristics

Stats

First seen: April 2022
Last seen: October 2026

MITRE ATT&CK techniques

16 techniques across 6 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.001Malicious Link

TA0003 Persistence

T1137Office Application Startup
- T1137.001Office Template Macros

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.010Command Obfuscation
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0040Patchwork

Alert name variants

Alert Name	Engine
Document-Excel.Trojan.Backconfig	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.Backconfig	ATP Sandbox Adv. Heuristics
Win32.Backdoor.Backconfig	ATP Sandbox Adv. Heuristics

Related families

QakBot Bazar PlugX InvisiMole Latrodectus