Backdoor.Win64.LOTUSBLOSSOM.ILE

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

• %System%\config\systemprofile\AppData\Roaming\Microsoft\Protect\Windows\DMI{Random 6 characters}.DAT

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %System%\config\systemprofile\AppData\Roaming\Microsoft\Protect\Windows

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Backdoor Routine

This Backdoor connects to the following URL(s) to send and receive commands from a remote malicious user:

• https://{BLOCKED}.{BLOCKED}.{BLOCKED}.19
• https://{BLOCKED}.{BLOCKED}.{BLOCKED}.198
• https://www.{BLOCKED}sky.com
• https://www.{BLOCKED}z.com

However, as of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following data:

• System Information:
  • Hostname
  • IPv4 address
  • Default Gateway
  • Date and Time

Other Details

This Backdoor does the following:

• It requires being registered as a service to properly execute.
• It checks for the presence of the file:
  • %Temp%\TS_FB56.tmp

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)