Backdoor.Win64.COBEACON.ZCLG.enc

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado. Se conecta a un sitio Web para enviar y recibir información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Connect and disconnect to a named pipe
• Escalate privileges
• Execute arbitrary commands
• Impersonate tokens
• Inject code into processes
• Manage directories (Create, Remove, Set Directory)
• Manage files (List, Create, Delete, Modify, Rename, Copy)
• Manage processes (List, Create, Terminate)
• List Drive Information
• Use/purge Kerberos tickets

Se conecta a los sitios Web siguientes para enviar y recibir información:

• http://{BLOCKED}g-f12b.azuer.workers.dev/feedback/js/help/prod/service/lazy.min.js
• http://{BLOCKED}g-f12b.azuer.workers.dev/we/s/h36B915845CCD42D1_App_Scripts/jquery.signalR2.1.1.min.js

Robo de información

Recopila los siguientes datos:

• Username
• Computer name
• Operating System Version
• Executable used to load the sample

Otros detalles

Hace lo siguiente:

• It requires being loaded by mscorsvc.dll located in %windows%\assembly directory to decrypt the content of this file → detected as Backdoor.Win64.COBEACON.ZCLG
• This sample needs to be located in the %windows%\assembly directory and have a file name of 'msco.conf' to execute properly.