xCaon

ATP Sandbox Adv. Heuristics

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

11 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1547Boot or Logon Autostart Execution

TA0005 Stealth

T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1016System Network Configuration Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0136IndigoZebra

Alert name variants

Alert Name	Engine
Win32.Trojan.Xcaon	ATP Sandbox Adv. Heuristics

Related blogs

Cloud Threats Memo: Preventing the Exploitation of Dropbox as a Command and Control

July 8, 20211 min read

Related families

Latrodectus QakBot Bazar Bisonal Cobalt Strike