Contopee
Aliases: WHITEOUT
- First seen
- 2015-01-01 00:00:00
- Malware type
- backdoor, rat
- Profile updated
- 2026-07-07 12:46:25
Targeted industries: government-and-public-sector financial-services technology-and-telecommunications
Context
FireEye described this malware as a proxy-aware backdoor that communicates using a custom-encrypted binary protocol. It may use the registry to store optional configuration data. The backdoor has been observed to support 26 commands that include directory traversal, file system manipulation, data archival and transmission, and command execution.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Contopee_Auto (yara-rule)
Reports & references
- Mandiant — Rpt Apt38 (report)
- web.archive.org — Swift Attackers Malware Linked More Financial Attacks (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Contopee (report)
- Broadcom/Symantec — Swift Attackers Malware Linked More Financial Attacks (report)