Backdoor.Win64.BRUTEL.YXCIW

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Manage Files(Create, Delete, Modify, Move, Copy)
• Manage Directories(Create, Remove)
• Manage Processes(Create, Open, Terminate)
• Manage Services(Create, Start)
• Escalate Privileges
• Impersonate Token
• Enumerate Registries
• Read/Modify File time
• Upload/download files
• Decode Kerberos tickets and convert to hashcat
• Scan Ports
• Push Scheduled Task Thru Group Policy Objects
• Execute WMI Commands
• Take Screenshots
• Query various LDAP queries to the domain or forest
• Execute Commands using SMB, TCP, WMI, WinRM and managing remote services over RPC

Robo de información

Recopila los siguientes datos:

• User Name
• Computer Name
• Local IP Address
• OS Info
• RAM Info
• Current Process ID
• Network Adapter Info