Backdoor.Win64.BRUTEL.YXCIW

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Manage Files(Create, Delete, Modify, Move, Copy)
• Manage Directories(Create, Remove)
• Manage Processes(Create, Open, Terminate)
• Manage Services(Create, Start)
• Escalate Privileges
• Impersonate Token
• Enumerate Registries
• Read/Modify File time
• Upload/download files
• Decode Kerberos tickets and convert to hashcat
• Scan Ports
• Push Scheduled Task Thru Group Policy Objects
• Execute WMI Commands
• Take Screenshots
• Query various LDAP queries to the domain or forest
• Execute Commands using SMB, TCP, WMI, WinRM and managing remote services over RPC

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}tecuptimehost.com:8080/admin.php?login=

Information Theft

This Backdoor gathers the following data:

• User Name
• Computer Name
• Local IP Address
• OS Info
• RAM Info
• Current Process ID
• Network Adapter Info