{
  "type": "malware",
  "spec_version": "2.1",
  "id": "malware--db1355a7-e5c9-4e2c-8da7-eccf2ae9bf5c",
  "created": "2018-04-18T17:59:24.739Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/software/S0199",
      "external_id": "S0199"
    },
    {
      "source_name": "TURNEDUP",
      "description": "(Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)"
    },
    {
      "source_name": "FireEye APT33 Sept 2017",
      "description": "O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.",
      "url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
    },
    {
      "source_name": "FireEye APT33 Webinar Sept 2017",
      "description": "Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.",
      "url": "https://www.brighttalk.com/webcast/10703/275683"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-04-25T14:44:50.321Z",
  "name": "TURNEDUP",
  "description": "[TURNEDUP](https://attack.mitre.org/software/S0199) is a non-public backdoor. It has been dropped by [APT33](https://attack.mitre.org/groups/G0064)'s [StoneDrill](https://attack.mitre.org/software/S0380) malware. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)",
  "is_family": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Windows"
  ],
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_version": "1.1",
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_contributors": [
    "Christiaan Beek, @ChristiaanBeek",
    "Ryan Becwar"
  ],
  "x_mitre_aliases": [
    "TURNEDUP"
  ]
}