BKDR_COBEACON.ZLFL-A

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Add or modify an environment variable
• Alternate Parent Process
• Change file time
• Escalate privilege
• File System Commands
• Get Drives
• Inject Code into a process
• List Processes
• Manage Service
• Open a process
• Sleep
• Steal or Make token
• Terminate process
• Use and Purge Kerberos Tickets
• Create, Connect and Disconnect to named pipe
• Modify file
• Set Current Directory
• Write a binary file
• Search for string in a file
• Create Process
• Check Loopback address
• Find File
• Create a directory
• Delete a directory

It connects to the following websites to send and receive information:

• https://{BLOCKED}.{BLOCKED}.225.68/z/msnbc2_live01@3121/manifest.f4m?hdcore=3.1&g={Encrypted Environment Information}

However, as of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following data:

• Malware Process ID
• Operating System Version
• IP address
• Computer name
• User name

Other Details

This Backdoor does the following:

• This backdoor creates the following header to cover for the connection with the malicious URL:
  • https://{BLOCKED}prod-lh.akamaihd.net/z/msnbc2_live01@3121/manifest.f4m?hdcore=3.1&g={Encrypted Environment Information}