Backdoor.ASP.SILOCK.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Este malware se puede alojar en un sitio Web y ejecutar cuando un usuario accede a dicho sitio Web.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware se puede alojar en un sitio Web y ejecutar cuando un usuario accede a dicho sitio Web.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Depending on the request header parameters, it may execute the following commands:
  • -1: Retrieves Azure information of all files, file owners, file sizes, uploader name and id, folder path and name, and users information from institution database and sent via response header in GZIP stream
  • -2: Deletes "Health Check Service" from users database
  • (no parameter):
    • Retrieves specified folder ID (from header "X-siLocked-Step2") and file ID (from header "X-siLocked-Step3") and sent via response header in GZIP stream
    • Else it adds a new admin user "Health Check Service" in the user database with active session and long timeout.

Robo de información

Recopila los siguientes datos:

• Azure information
• Information from databases like:
  • files
  • file owners
  • file sizes
  • uploader name and id
  • folder path and name
  • users information from institution database

Otros detalles

Hace lo siguiente:

• It requires a specific password to be sent in the request headers while accessing the website where it is hosted on.