Backdoor.Win64.COBEACON.OSLJER

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Connect and disconnect to a named pipe
• Escalate privileges
• Execute arbitrary commands
• Impersonate tokens
• Inject code into processes
• List drive information
• Manage directories (Create, Remove, Set Directory)
• Manage files (List, Create, Delete, Modify, Move, Copy)
• Manage processes (List, Create, Suspend, Terminate)
• Upload/download files

Robo de información

Recopila los siguientes datos:

• Username
• Computer Name
• OS Version
• Executable used to load the sample

Otros detalles

Hace lo siguiente:

• It requires being executed in a specific directory and using a specific file name to proceed with its intended routine.
• It connects to the following URL to download its component which it will load in its memory and perform its malicious routine:
  • https://d{BLOCKED}torage.firmware.keenetic.pro/Communicate/certenroll/LGKWDB7K