Timestomp  The backdoor modifies the date and time of the dropped files using the “touch” command  Discovery  T1082  System Information Discovery  The backdoor collects various information to send to the C&C server  Collection  T1560.003  Archive Collected Data: Archive via Custom Method  The backdoor encrypts the data before exfiltration  Command and Control  T1095  Non-Application Layer Protocol