Loading malware…
KOMPROGO is a malware family associated with APT32 (also known as OceanLotus). FireEye identifies it as one of APT32’s signature malware payloads, alongside WINDSHIELD, SOUNDBITE, and PHOREAL. It was observed in APT32 operations including activity in 2016 targeting a consumer products entity in the Philippines. High-confidence capabilities directly mentioned in the content include running WMI queries and creating a reverse shell. More broadly, the associated APT32 intrusion set used spear-phishing emails with ActiveMime ".mht" lure documents disguised as ".doc" files to entice victims to enable macros, after which multiple payloads were downloaded from remote servers. APT32 is assessed by FireEye to align with Vietnamese state interests and has targeted private-sector organizations with interests in Vietnam, including manufacturing, consumer products, hospitality, network security, and technology infrastructure firms, as well as foreign governments, dissidents, journalists, and diaspora communities. The content does not provide KOMPROGO-specific indicators of compromise beyond its naming and association with APT32 operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD, KOMPROGO, SOUNDBITE, and PHOREAL.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor capable of running WMI queries for host interrogation.
Fully-featured backdoor supporting process/file/registry management, reverse shell, file transfer, WMI queries, and host reconnaissance.
Malware/tool capable of creating a reverse shell.
Malware capable of running WMI queries for host discovery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.