Pteranodon

ATP Sandbox Adv. HeuristicsAV

Description

Pteranodon is a custom backdoor used by the Gamaredon Group in its campaigns against Ukrainian targets.

Stats

First seen: January 2022
Last seen: October 2026

Also known as

Pterodo

MITRE ATT&CK techniques

17 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.005Visual Basic
T1106Native API

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.007Dynamic API Resolution
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32
- T1218.005Mshta
T1497Virtualization/Sandbox Evasion

TA0007 Discovery

T1083File and Directory Discovery

TA0009 Collection

T1074Data Staged
- T1074.001Local Data Staging
T1113Screen Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0047Gamaredon Group

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.Pteranodon	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Image.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Pterodo	ATP Sandbox Adv. Heuristics
Trojan.JS.Pterodo.1	AV
Trojan.Pterodo.43	AV
Win32.Backdoor.Pterodo	ATP Sandbox Adv. Heuristics
Win32.Downloader.Pterodo	ATP Sandbox Adv. Heuristics
Win32.Trojan.Pteranodon	ATP Sandbox Adv. Heuristics
Win32.Trojan.Pterodo	ATP Sandbox Adv. Heuristics

Related families

PlugX QakBot Metamorfo Bisonal Latrodectus

References