BKDR_COBEACON.B

Abre puertos aleatorios. Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\_MEI2802\Crypto.Cipher._AES.pyd
• %User Temp%\_MEI2802\MSVCR100.dll
• %User Temp%\_MEI2802\_bz2.pyd
• %User Temp%\_MEI2802\_ctypes.pyd
• %User Temp%\_MEI2802\_hashlib.pyd
• %User Temp%\_MEI2802\_lzma.pyd
• %User Temp%\_MEI2802\_socket.pyd
• %User Temp%\_MEI2802\_ssl.pyd
• %User Temp%\_MEI2802\df_newc2_stageless.exe.manifest
• %User Temp%\_MEI2802\pyexpat.pyd
• %User Temp%\_MEI2802\python34.dll
• %User Temp%\_MEI2802\select.pyd
• %User Temp%\_MEI2802\unicodedata.pyd
• %User Temp%\_MEI2802\Include\pyconfig.h
• %User Temp%\_MEI2802\base_library.zip

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

Crea las carpetas siguientes:

• %User Temp%\_MEI2802
• %User Temp%\_MEI2802\Include

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).

Rutina de puerta trasera

Abre un puerto aleatorio para que un usuario remoto pueda conectarse al sistema afectado. Una vez se ha establecido la comunicación correctamente, el usuario remoto ejecuta los comandos en el sistema afectado.

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Set sleep time
• Execute shell command
• Execute PowerShell command using Powershell
• Execute PowerShell cmdlets without powershell.exe
• Execute PowerShell command by injecting to a specific process
• Execute command from a specific directory
• Spawn session for listener
• Spawn specific architecture and full path to a program to spawn
• Inject a session into a specific process
• Inject a 64-bit version of malware to a 64-bit process
• Inject Reflective DLL into a process
• Inject a shellcode from a local file into a specific process
• Inject a shellcode into a spawned process
• Assign alternate parent process
• Execute command with another process as the parent
• Spawn a session with another process as the parent
• Download file/s
• Display files currently being downloaded
• Upload file/s
• List files in current directory
• Create new folder
• Delete file/folder
• Copy file/s
• Move file/s
• Log keystrokes
• Take screenshots
• Display currently executing backdoor command
• Terminate currently executing backdoor command
• Setup SOCKS4a proxy server
• Setup reverse pivot
• Disable reverse port forward
• List privilege escalation exploits
• Perform exploit to elevate privilege
• Execute command using known credentials
• Spawn session using known credentials
• Impersonate a token for the SYSTEM account
• Spawn a session in a process with elevated rights
• Enable privileges assigned to current access token
• Execute Mimikatz to recover user logon passwords
• Scan ports
• Enumerate network and hosts
• Impersonate a token from an existing process
• Inject a Kerberos ticket into the current session
• Execute a payload on a remote host
• Execute a payload on a remote host using PowerShell
• Execute a payload on a remote host using WinRM
• Deliver payload via Windows Management Instrumentation
• Terminate itself
• Terminate a process
• Modify timestamps

A fecha de redacción de este documento no es posible acceder a los servidores mencionados.