S0098: T9000

T9000 is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. [1] [2]

EnterpriseS0098MalwareObject v1.1ModifiedApr 25, 2025, 14:43 UTC (UTC+00:00)

S0098: T9000 describes [T9000](https://attack.mitre.org/software/S0098) is a backdoor that is a newer variant of the T5000 malware family, also known as Plat1. Its primary function is to gather information about the victim. It has been used in multiple targeted attacks against U.S.-based organizations. (Citation: FireEye admin@338 March 2014) (Citation: Palo Alto T9000 Feb 2016)

Executive priority

S0098: T9000 is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0098: T9000 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0098: T9000 appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

T9000

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques13 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1016	System Network Configuration Discovery	T9000 gathers and beacons the MAC and IP addresses during installation.[2]
Enterprise	T1124	System Time Discovery	T9000 gathers and beacons the system time during installation.[2]
Enterprise	T1119	Automated Collection	T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.[2]
Enterprise	T1546.010	AppInit DLLsSub-technique	If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll` and `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1`.[2]
Enterprise	T1082	System Information Discovery	T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.[2]
Enterprise	T1574.001	DLLSub-technique	During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	T9000 performs checks for various antivirus and security products during installation.[2]
Enterprise	T1123	Audio Capture	T9000 uses the Skype API to record audio and video calls. It writes encrypted data to `%APPDATA%\Intel\Skype`.[2]
Enterprise	T1033	System Owner/User Discovery	T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.[2]
Enterprise	T1560.003	Archive via Custom MethodSub-technique	T9000 encrypts collected data using a single byte XOR key.[2]
Enterprise	T1113	Screen Capture	T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.[2]
Enterprise	T1125	Video Capture	T9000 uses the Skype API to record audio and video calls. It writes encrypted data to `%APPDATA%\Intel\Skype`.[2]
Enterprise	T1120	Peripheral Device Discovery	T9000 searches through connected drives for removable storage devices.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.1
Created: May 31, 2017, 21:33 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:43 UTC (UTC+00:00)
Raw hash: a3a4ff7fc97576a1...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Current bundle	`a3a4ff7fc975…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Older bundle	`a3a4ff7fc975…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Older bundle	`a3a4ff7fc975…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
FireEye admin@338 March 2014
Moran, N. and Lanstein, A.. (2014, March 25). Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370. Retrieved April 15, 2016.
Open source URL
[2]
Palo Alto T9000 Feb 2016
Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.
[3]
mitre-attackS0098
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use