T1489 Service Stop in real malware

ATT&CK technique T1489 Service Stop appears in 2 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: HUILoader, Pioneer.

Tactics: impact

Prevalence in the corpus

• Samples exhibiting T1489: 2
• Share of analyzed corpus: 0.0%
• Last 7 days: 0 · prior 7 days: 0 (flat)

Malware families using T1489

• HUILoader - 1 sample
• Pioneer - 1 sample

Example samples

• ded0904cb9fcc76f269316853e0f8f0f5dcc97311702f166a6c7ca6ca951f01e - malicious
• 0e61e8e6d4118a5b4a3a11fdf887fd2f504be8468c56dd5601c5d41fb5e845eb - malicious

Canonical technique definition: MITRE ATT&CK T1489 (ATT&CK v19.1, CC BY 4.0).

Frequently asked about T1489

How common is ATT&CK T1489 (Service Stop) in real malware?

ATT&CK technique T1489 Service Stop appears in 2 publicly analyzed samples on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is flat (0 recent vs 0 prior). Most associated families: HUILoader, Pioneer.

Which malware families use T1489?

In this corpus T1489 is most associated with HUILoader (1), Pioneer (1). Counts are analyzed samples per family in which the technique was observed.

What share of analyzed samples use T1489?

0.0% of the publicly analyzed corpus (2 of 114578 samples) exhibits T1489. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.

All ATT&CK techniques in the corpus · Latest analyzed threats