BUBBLEWRAP

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[BUBBLEWRAP](https://attack.mitre.org/software/S0043) is a full-featured, second-stage backdoor used by the [admin@338](https://attack.mitre.org/groups/G0018) group. It is set to run when the system boots and includes functionality to check, upload, and register plug-ins that can further enhance its capabilities. (Citation: FireEye admin@338)

Associated Techniques (3)

ID	ATT&CK	Tactics
T1071.001	Web Protocols	-
T1082	System Information Discovery	-
T1095	Non-Application Layer Protocol	-

Aliases (105)

Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper Backdoor.APT.FakeWinHTTPHelper

Used by Actors (1)

admin@338
Unknown

Metadata

ID:	59
Created:	13/01/2026 17:48
Updated:	06/03/2026 16:00