Backdoor.Win64.LEGIRAT.ZKLJ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Ruft bestimmte Informationen vom betroffenen System ab.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• c88b0910ed61c17a780135d615c43ef6917616749

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Datendiebstahl

Ruft folgende Informationen vom betroffenen System ab:

• Hostname
• Locale Info

Andere Details

Es macht Folgendes:

• It impersonates the logged on user.
• It uses the following URL to use Slack's API for its malicious purposes:
  • https://{BLOCKED}k.com/api/conversations.list?exclude_archived=true → lists all the conversations(channels, direct messages, and group chats) available in the Slack workspace
  • https://{BLOCKED}k.com/api/files.upload?&channels={channel ID} → uploads a file to one or more channels, direct messages in the Slack workspace
  • https://{BLOCKED}k.com/api/conversations.create → creates a new channel (public or private) in the Slack workspace
  • https://{BLOCKED}k.com/api/conversations.update → updates the settings of an existing Slack channel
  • https://{BLOCKED}k.com/api/conversations.delete → delete a Slack channel (public or private)
  • https://{BLOCKED}k.com/api/conversations.postMessage → sends a message to a specific conversation in Slack workspace
  • https://{BLOCKED}k.com/api/conversations.history?limit=200&channel={channel ID} → retrieves the past 200 messages from a specified Slack channel (public or private)
• It retrieves its encrypted component to communicate with Slack workspace using the following URL:
  • https://{BLOCKED}ell.io/notes/58434-3
  • https://{BLOCKED}l.xlog.app/page1
• The Slack communication was established through the use of this hardcoded authentication token:
  • {BLOCKED}19976938784-7094277537125-7090647648246-e3a9e4feeb2fe448f889890be6e1299e → Inaccessible; Token revoked