Backdoor.Win64.COBEACON.ZAMD

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• https://{BLOCKED}hk9.execute-api.eu-north-1.amazonaws.com/us/js/time/code/jquery-3.3.1.min.js → contains a modified code of the original jquery-3.3.1.min.js

Information Theft

This Backdoor gathers the following data:

• Computer Name
• User Name
• Loader Process Name

Other Details

This Backdoor does the following:

• It requires to be loaded by svchost.exe to continue with its malicious routine.
• It requires the following file in order to decrypt its payload:
  • %System Root%\Users\Default\AppData\Local\Microsoft\Windows\shell\Default.xml → detected as Backdoor.Win64.COBEACON.ZAMD.enc
• If it is loaded by svchost.exe, it will open and read the Default.xml file into its memory, decrypt the file in memory and execute the decrypted code.

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)