Backdoor.Win64.COBEACON.OSLJET

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Connect and disconnect to a named pipe
• Escalate privileges
• Execute arbitrary commands
• Impersonate tokens
• Inject code into processes
• List drive information
• Manage directories (Create, Remove, Set Directory)
• Manage files (List, Create, Delete, Modify, Move, Copy)
• Manage processes (List, Create, Suspend, Terminate)
• Upload/download files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.{BLOCKED}.246

Information Theft

This Backdoor gathers the following data:

• Username
• Computer Name
• OS Version
• Executable used to load the sample

Other Details

This Backdoor does the following:

• It requires being executed in a specific directory and using a specific file name to proceed with its intended routine.
• It connects to the following URL to download its component which it will load in its memory and perform its malicious routine:
  • https://d{BLOCKED}torage.firmware.keenetic.pro/Communicate/certenroll/LGKWDB7K