Malware
metaMain
S1059 · Windows
metaMain is a backdoor used by Metador to maintain long-term access to compromised machines.
it has also been used to decrypt Mafalda into memory.
ATT&CK S1059
Malware family
Sigma rules0
YARA rules0
Live IOCs0
▤
Techniques Used
28ATT&CK techniques this malware is documented performing. Each links to its detections - Sigma, vendor SIEM rules, and analytics - so you catch the behaviour even when the binary changes.
⚊
Live Indicators
Indicators are defanged for safe handling. Newest first.
Aliases
metaMain
External lookups - second-class, for what we don’t hold ourselves