H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Matryoshka

[Matryoshka](https://attack.mitre.org/software/S0167) is a malware framework used by [CopyKittens](https://attack.mitre.org/groups/G0052) that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Matryoshka](https://attack.mitre.org/software/S0167) is a malware framework used by [CopyKittens](https://attack.mitre.org/groups/G0052) that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)

Labels

malware
11 recorded

Relationships

uses
from CopyKittens
Group
uses
to Command and Scripting Interpreter
Technique
uses
to Credentials from Password Stores
Technique
uses
to DNS
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Keylogging
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rundll32
Technique
uses
to Scheduled Task
Technique
uses
to Screen Capture
Technique
4 external

References

mitre-attack
S0167
open
Matryoshka
—
ClearSky Wilted Tulip July 2017
http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf
open
CopyKittens Nov 2015
https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance