BKDR_LISUIFE.B

This backdoor is implicated in the 2015 compromise of the German parliament, also known as Bundestag. This malware connects to a specific C&C server that we believe was controlled by Operation Pawn Storm during extended periods from February 2014 - February 2015.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is a component of other malware.

It connects to a website to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor is a component of other malware.

Backdoor Routine

This backdoor connects to the following websites to send and receive information:

• {BLOCKED}.{BLOCKED}.112.10

However, as of this writing, the said sites are inaccessible.

NOTES:

This malware is capable of the receiving the following arguments:

• -Si
• -Sp
• -Up
• -Pp
• -Pi
• -SSL

This backdoor attempts to connect to the remote C&C server and sends packets depending on the argument received and waits for possible connection. It is capable of receiving arbitrary commands from a remote attacker that may be executed on the affected system.