1. Home
  2. Software
  3. HTRAN

HTRAN

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. [1][2]

ID: S0040
ⓘ
Associated Software: HUC Packet Transmit Tool
ⓘ
Type: TOOL
ⓘ
Platforms: Linux, Windows
Version: 1.2
Created: 31 May 2017
Last Modified: 23 April 2021

Associated Software Descriptions

Name Description
HUC Packet Transmit Tool

[1]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1055 Process Injection

HTRAN can inject into into running processes.[2]
Enterprise T1090 Proxy

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.[1][2]
Enterprise T1014 Rootkit

HTRAN can install a rootkit to hide network connections from the host OS.[2]

Groups That Use This Software

ID Name References
G0005 APT12

[3]
G0093 GALLIUM

[4][5]

References

  1. Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.
  2. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  3. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  1. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  2. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.