backdoor.json

{
  "authors": [
    "raw-data"
  ],
  "category": "tool",
  "description": "A list of backdoor malware.",
  "name": "Backdoor",
  "source": "Open Sources",
  "type": "backdoor",
  "uuid": "75436e27-cb57-4f32-bf1d-9636dd78a2bf",
  "values": [
    {
      "description": "Cross-platform malware written in Golang, compatible with Linux and Windows. Although there are some minor differences, both variants have the same functionality. The malware communicates with a CnC server using HTTP requests and performs functions based on the received commands. Results of command execution are sent in HTTP POST requests data (RSA-encrypted). Main functionalities are: (1) Execute arbitrary shell commands, (2) Upload/Download files. The PE variant of the infection, in addition, executes PowerShell scripts. A .Net version was also observed in the wild.",
      "meta": {
        "date": "July 2018.",
        "refs": [
          "https://blog.jpcert.or.jp/2018/07/malware-wellmes-9b78.html"
        ]
      },
      "related": [
        {
          "dest-uuid": "d84ebd91-58f6-459f-96a1-d028a1719914",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        }
      ],
      "uuid": "e0e79fab-0f1d-4fc2-b424-208cb019a9cd",
      "value": "WellMess"
    },
    {
      "description": "The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU. It is enabled by a model-specific-register control bit, and then toggled with a launch-instruction. The embedded core is then fed commands, wrapped in a specially formatted x86 instruction. The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks.\n\nWhile the backdoor should require kernel level access to activate, it has been observed to be enabled by default on some systems, allowing any unprivileged code to modify the kernel.\n\nThe rosenbridge backdoor is entirely distinct from other publicly known coprocessors on x86 CPUs, such as the Management Engine or Platform Security Processor; it is more deeply embedded than any known coprocessor, having access to not only all of the CPU's memory, but its register file and execution pipeline as well.",
      "meta": {
        "date": "August 2018",
        "refs": [
          "https://www.bleepingcomputer.com/news/security/backdoor-mechanism-discovered-in-via-c3-x86-processors/",
          "https://github.com/xoreaxeaxeax/rosenbridge",
          "https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Christopher%20Domas/DEFCON-26-Christopher-Domas-GOD-MODE-%20UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf"
        ]
      },
      "uuid": "2bb165dc-9f93-11e8-ae64-d3dbab0dd786",
      "value": "Rosenbridge"
    },
    {
      "description": "The purpose of the macro was to download and execute a variant of ServHelper that set up reverse SSH tunnels that enabled access to the infected host through the Remote Desktop Protocol (RDP) port 3389.\n\n\"Once ServHelper establishes remote desktop access, the malware contains functionality for the threat actor to “hijack” legitimate user accounts or their web browser profiles and use them as they see fit,\" researchers from Proofpoint explain in an analysis released today.\n\nThe other ServHelper variant does not include the tunneling and hijacking capabilities and functions only as a downloader for the FlawedGrace RAT.",
      "meta": {
        "refs": [
          "https://www.bleepingcomputer.com/news/security/new-servhelper-backdoor-and-flawedgrace-rat-pushed-by-necurs-botnet/"
        ]
      },
      "uuid": "8b50360c-4d16-4f52-be75-e74c27f533df",
      "value": "ServHelper"
    },
    {
      "description": "The Rising Sun backdoor uses the RC4 cipher to encrypt its configuration data and communications. As with most backdoors, on initial infection, Rising Sun will send data regarding the infected system to a command and control (C2) site. That information captures computer and user name, IP address, operating system version and network adapter information. Rising Sun contains 14 functions  including executing commands, obtaining information on disk drives and running processes, terminating processes, obtaining file creation and last access times, reading and writing files, deleting files, altering file attributes, clearing the memory of processes and connecting to a specified IP address.",
      "meta": {
        "refs": [
          "https://www.bluvector.io/threat-report-rising-sun-operation-sharpshooter/"
        ]
      },
      "uuid": "0ae6636e-87e4-4b4c-a1c8-e14e1cab964f",
      "value": "Rising Sun"
    },
    {
      "description": "A new backdoor was observed using the Github Gist service and the Slack messaging system as communication channels with its masters, as well as targeting a very specific type of victim using a watering hole attack.\nThe backdoor dubbed SLUB by the Trend Micro Cyber Safety Solutions Team who detected it in the wild is part of a multi-stage infection process designed by capable threat actors who programmed it in C++.\nSLUB uses statically-linked curl, boost, and JsonCpp libraries for performing HTTP request, \"extracting commands from gist snippets,\" and \"parsing Slack channel communication.\"\nThe campaign recently observed by the Trend Micro security researchers abusing the Github and Slack uses a multi-stage infection process.",
      "meta": {
        "refs": [
          "https://www.bleepingcomputer.com/news/security/new-slub-backdoor-uses-slack-github-as-communication-channels/"
        ]
      },
      "related": [
        {
          "dest-uuid": "bb6492fa-36b5-4f4a-a787-e718e7f9997f",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        }
      ],
      "uuid": "a4757e11-0837-42c0-958a-7490cff58687",
      "value": "SLUB"
    },
    {
      "description": "Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.",
      "meta": {
        "refs": [
          "https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/"
        ]
      },
      "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
      "value": "Asruex"
    },
    {
      "meta": {
        "refs": [
          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
        ]
      },
      "uuid": "aefe3603-8f96-425c-9f71-9fe21334f224",
      "value": "FlowerPippi"
    },
    {
      "description": "FreeBSD-based payload, Speculoos was delivered by exploiting CVE-2019-19781, a vulnerability affecting the Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP appliances that allowed an adversary to remotely execute arbitrary commands. This vulnerability was first disclosed on December 17, 2019 via security bulletin CTX267679 which contained several mitigation recommendations. By January 24, 2020, permanent patches for the affected appliances were issued. Based on the spread of industries and regions, in addition to the timing of the vulnerability disclosure, we believe this campaign may have been more opportunistic in nature compared to the highly targeted attack campaigns that are often associated with these types of adversaries. However, considering the exploitation of the vulnerability in conjunction with delivery of a backdoor specifically designed to execute on the associated FreeBSD operating system indicates the adversary was absolutely targeting the affected devices.",
      "meta": {
        "refs": [
          "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
        ]
      },
      "related": [
        {
          "dest-uuid": "9c124874-042d-48cd-b72b-ccdc51ecbbd6",
          "tags": [
            "estimative-language:likelihood-probability=\"very-likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "201e8794-a93b-476f-9436-1dd859c6e5d9",
      "value": "Speculoos"
    },
    {
      "description": "Mori Backdoor has been used by Seedworm.",
      "meta": {
        "refs": [
          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east"
        ]
      },
      "uuid": "e663ac1b-9474-4f9a-b0c8-184861327dd7",
      "value": "Mori Backdoor"
    },
    {
      "description": "Something that made the brute-force attacks on RDP connections easier was a new module of the notorious Trojan, TrickBot. It now seems that the TrickBot developers have a new tactic. Cybersecurity researchers have discovered a new phishing campaign that delivers a stealthy backdoor called BazarBackdoor, which can be used to compromise and gain full access to corporate networks.\nAs is the case with 91% of cyberattacks, this one starts with a phishing email. A range of subjects are used to personalize the emails: Customer complaints, coronavirus-themed payroll reports, or employee termination lists. All these emails contain links to documents hosted on Google Docs. To send the malicious emails, the cybercriminals use the marketing platform Sendgrid.\nThis campaign uses spear phishing, which means that the perpetrators have made an effort to ensure that the websites sent in the emails seem legitimate and correspond to the emails subjects.",
      "meta": {
        "refs": [
          "https://www.advanced-intel.com/post/anatomy-of-attack-inside-bazarbackdoor-to-ryuk-ransomware-one-group-via-cobalt-strike",
          "https://www.pandasecurity.com/en/mediacenter/business/bazarbackdoor-trickbot-backdoor/"
        ],
        "synonyms": [
          "BEERBOT",
          "KEGTAP",
          "Team9Backdoor",
          "bazaloader",
          "bazarloader",
          "bazaarloader"
        ]
      },
      "uuid": "1523a693-5d90-4da1-86d2-b5d22317820d",
      "value": "BazarBackdoor"
    },
    {
      "description": "Backdoor.Sunburst is Malwarebytes’ detection name for a trojanized update to SolarWind’s Orion IT monitoring and management software.",
      "meta": {
        "refs": [
          "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
          "https://www.varonis.com/blog/solarwinds-sunburst-backdoor-inside-the-stealthy-apt-campaign/",
          "https://blog.malwarebytes.com/detections/backdoor-sunburst/",
          "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/",
          "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        ],
        "synonyms": [
          "Solarigate"
        ]
      },
      "related": [
        {
          "dest-uuid": "d9b2305e-9802-483c-a95d-2ae8525c7704",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "dropped-by"
        },
        {
          "dest-uuid": "d7247cf9-13b6-4781-b789-a5f33521633b",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "16902832-0118-40f2-b29e-eaba799b2bf4",
      "value": "SUNBURST"
    },
    {
      "description": "BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant",
      "meta": {
        "refs": [
          "https://troopers.de/troopers22/talks/7cv8pz/",
          "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896?gi=1effe9eb6507",
          "https://twitter.com/cyb3rops/status/1523227511551033349",
          "https://twitter.com/CraigHRowland/status/1523266585133457408"
        ]
      },
      "uuid": "0c3b1aa5-3a33-493e-9126-28ebced4ed09",
      "value": "BPFDoor"
    },
    {
      "description": "According to Mandiant, this malware family is attributed to potential chinese background and its Linux variant is related to exploitation of Fortinet's SSL-VPN (CVE-2022-42475).",
      "meta": {
        "refs": [
          "https://malpedia.caad.fkie.fraunhofer.de/details/win.boldmove",
          "https://malpedia.caad.fkie.fraunhofer.de/details/elf.boldmove",
          "https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw"
        ]
      },
      "uuid": "2cef78bd-f097-4477-8888-79359042b515",
      "value": "BOLDMOVE"
    },
    {
      "meta": {
        "refs": [
          "https://securelist.com/bad-magic-apt/109087/"
        ]
      },
      "uuid": "c866b002-1cb6-4c91-8a8b-f0b0c6ac2b1a",
      "value": "PowerMagic"
    },
    {
      "description": "VEILEDSIGNAL is a backdoor written in C that is able to execute shellcode and terminate itself. Additionally, VEILEDSIGNAL relies on additional modules that connect via Windows named pipes to interact with the Command and Control(C2) infrastructure.",
      "meta": {
        "refs": [
          "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
        ]
      },
      "uuid": "f482f9bb-ced1-4a2f-90cd-07df7163b44f",
      "value": "VEILEDSIGNAL"
    },
    {
      "description": "POOLRAT is a C/C++ macOS backdoor capable of collecting basic system information and executing commands. The commands performed include running arbitrary commands, secure deleting files, reading and writing files, updating the configuration.",
      "meta": {
        "refs": [
          "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
        ]
      },
      "uuid": "617009c2-e6bc-4881-8f46-b9b4a68f4c04",
      "value": "POOLRAT"
    },
    {
      "description": "BIGRAISIN is a C\\C++ Windows based backdoor. It is capable of executing downloaded commands, executing downloaded files, and deleting files. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "6d7adc1e-c6a5-42a2-8477-ce51b40674a6",
      "value": "BIGRAISIN"
    },
    {
      "description": "FASTFIRE is a malicious APK that connects to a server and sends details of the compromised device back to command and control (C2). Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "767b4d07-2746-4ad2-bc79-de15fc495e3a",
      "value": "FASTFIRE"
    },
    {
      "description": "GRAYZONE is a C/C++ Windows backdoor capable of collecting system information, logging keystrokes, and downloading additional stages from the C2 server. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "0aea9604-62dd-4646-b47d-556e09ce558e",
      "value": "GRAYZONE"
    },
    {
      "description": "HANGMAN.V2 is a variant of the backdoor HANGMAN. HANGMAN.V2 is very similar to HANGMAN, but uses HTTP for the network communications and formats data passed to the C2 server differently. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "3e489132-8687-46b3-b9a7-74ba8fafaddf",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "variant-of"
        },
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "f62813e9-251f-4f5c-bf27-cba2d933392b",
      "value": "HANGMAN.V2"
    },
    {
      "description": "LOGCABIN is a file-less and modular backdoor with multiple stages. The stages consist of several VisualBasic and PowerShell scripts that are downloaded and executed. LOGCABIN collects detailed system information and sends it to the C2 before performing additional commands. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "43c91440-1f70-40df-b006-ae9507b04225",
      "value": "LOGCABIN"
    },
    {
      "description": "SOURDOUGH is a backdoor written in C that communicates via HTTP. Its capabilities include keylogging, screenshot capture, file transfer, file execution, and directory enumeration. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "8a52581c-3308-47b8-869a-cd06053c6eff",
      "value": "SOURDOUGH"
    },
    {
      "description": "TROIBOMB is a C/C++ Windows backdoor that is capable of collecting system information and performing commands from the C2 server. Availability: Non-public",
      "meta": {
        "refs": [
          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
        ]
      },
      "related": [
        {
          "dest-uuid": "aac49b4e-74e9-49fa-84f9-e340cf8bafbc",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "f8444fcc-730e-4898-8ef5-6cc1976ff475",
      "value": "TROIBOMB"
    },
    {
      "description": "ZIPLINE makes use of extensive functionality to ensure the authentication of its custom protocol used to establish command and control (C2).",
      "meta": {
        "refs": [
          "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        ]
      },
      "uuid": "14504cbe-8423-47aa-a947-a3ab5549a068",
      "value": "ZIPLINE"
    },
    {
      "description": "SPAWNSNAIL is a backdoor that listens on localhost. It is designed to run by injecting into the dsmdm process (process responsible for supporting mobile device management features). It creates a backdoor by exposing a limited SSH server on localhost port 8300. We assess that the attacker uses the SPAWNMOLE tunneler to interact with SPAWNSNAIL.\n\nSPAWNSNAIL's second purpose is to inject SPAWNSLOTH into dslogserver, a process supporting event logging on Connect Secure.",
      "meta": {
        "refs": [
          "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        ]
      },
      "related": [
        {
          "dest-uuid": "6fcf8d1f-2e68-4982-a579-2ca5595e4990",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        },
        {
          "dest-uuid": "e6cf28a6-94a9-4aab-b919-ad2f6a7e3b87",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "preceded-by"
        },
        {
          "dest-uuid": "6c89c51f-1b97-4966-abc1-9cf526bb2892",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "interacts-with"
        },
        {
          "dest-uuid": "2c237974-edc2-460a-90b5-20f699560da3",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "injects"
        }
      ],
      "uuid": "de390f3e-c0d1-4c70-b121-a7a98f7326aa",
      "value": "SPAWNSNAIL"
    },
    {
      "description": "BRICKSTORM is a Go backdoor targeting VMware vCenter servers. It supports the ability to set itself up as a web server, perform file system and directory manipulation, perform file operations such as upload/download, run shell commands, and perform SOCKS relaying. BRICKSTORM communicates over WebSockets to a hard-coded C2.",
      "meta": {
        "refs": [
          "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        ]
      },
      "related": [
        {
          "dest-uuid": "f288f686-b5b3-4c86-9960-5f8fb18709a3",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "used-by"
        }
      ],
      "uuid": "64a0e3ab-e201-4fdc-9836-85365dfa84bb",
      "value": "BRICKSTORM"
    },
    {
      "description": "PHANTOMNET is a modular backdoor that communicates using a custom communication protocol over TCP. PHANTOMNET's core functionality involves expanding its capabilities through a plugin management system. The downloaded plugins are mapped directly into memory and executed.",
      "meta": {
        "refs": [
          "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        ]
      },
      "related": [
        {
          "dest-uuid": "c5ea778c-df2f-4c63-b401-dded9cb2419c",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "is-deployed-by"
        },
        {
          "dest-uuid": "540b3e66-edbf-40ee-ae05-474b27c1ff40",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "executed-by"
        }
      ],
      "uuid": "f97ea150-a727-4d47-823a-41de07a43ea9",
      "value": "PHANTOMNET"
    },
    {
      "description": "TERRIBLETEA is a Go backdoor that communicates over HTTP using XXTEA for encrypted communications. It is built using multiple open-source Go modules and has a multitude of capabilities including Command execution, Keystroke logging, SOCKS5 proxy, Port scanning, File system interaction, SQL query execution, Screen captures, Ability to open a new SSH session, execute commands, and upload files to a remote server. ",
      "meta": {
        "refs": [
          "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        ]
      },
      "related": [
        {
          "dest-uuid": "083a637b-c58c-4ccb-ab59-81d783873e80",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "is-deployed-by "
        }
      ],
      "uuid": "4838b37b-2d1f-4cb8-945d-7185580f0bff",
      "value": "TERRIBLETEA"
    },
    {
      "description": "Merdoor is a fully-featured backdoor that appears to have been in existence since 2018.\nThe backdoor contains the following functionality: Installing itself as a service, Keylogging, A variety of methods to communicate with its command-and-control (C&C) server (HTTP, HTTPS, DNS, UDP, TCP), Ability to listen on a local port for commands\nInstances of the Merdoor backdoor are usually identical with the exception of embedded and encrypted configuration, which determines: C&C communication method, Service details, Installation directory\nTypically, the backdoor is injected into the legitimate processes perfhost.exe or svchost.exe.",
      "meta": {
        "refs": [
          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor"
        ]
      },
      "uuid": "8ebda9f4-f8f2-4d35-ba2b-d6ecb54b23d4",
      "value": "Merdoor"
    }
  ],
  "version": 20
}