Backdoor.Win64.LEGIRAT.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• cab0a9b41f6e44c24b9fd412b5e538c0

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Datendiebstahl

Folgende Daten werden gesammelt:

• Hostname
• Username
• Locale

Andere Details

Es macht Folgendes:

• It impersonates the logged on user.
• It uses the following URL to use Slack's API for its malicious purposes:
  • https://{BLOCKED}k.com/api/chat.postMessage
  • https://{BLOCKED}k.com/api/chat.update
  • https://{BLOCKED}k.com/api/chat.delete
  • https://{BLOCKED}k.com/api/files.upload?&channels=
  • https://{BLOCKED}k.com/api/conversations.list?exclude_archived=true
  • https://{BLOCKED}k.com/api/conversations.create
  • https://{BLOCKED}k.com/api/conversations.history?limit=200&channel=
• The Slack communication was established through the use of this hardcoded authentication token:
  • {BLOCKED}26427959425-5707141283990-5726497507873-511646c6920d425fc62e147145bc56db → Inacessible; token revoked
• It checks for the presence of the following files in order to proceed with its intended routine:
  • list.txt → encrypted payload
  • output.txt → encrypted payload