More_eggs
More_eggs is a JScript backdoor used by Cobalt Group and FIN6. Its name was given based on the variable "More_eggs" being present in its code. There are at least two different versions of the backdoor being used, version 2.0 and version 4.4. [1][2]
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography |
More_eggs has used an RC4-based encryption method for its C2 communications.[2] |
| Enterprise | T1140 | 反混淆/解码文件或信息 |
More_eggs will decode malware components that are then dropped to the system.[2] |
|
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell | |
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols | |
| Enterprise | T1132 | .001 | 数据编码: Standard Encoding |
More_eggs has used basE91 encoding, along with encryption, for C2 communication.[2] |
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File |
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.[5] |
| Enterprise | T1070 | .004 | 移除指标: File Deletion | |
| Enterprise | T1218 | .010 | 系统二进制代理执行: Regsvr32 |
More_eggs has used regsvr32.exe to execute the malicious DLL.[2] |
| Enterprise | T1082 | 系统信息发现 |
More_eggs has the capability to gather the OS version and computer name.[1][2] |
|
| Enterprise | T1033 | 系统所有者/用户发现 |
More_eggs has the capability to gather the username from the victim's machine.[1][2] |
|
| Enterprise | T1016 | 系统网络配置发现 |
More_eggs has the capability to gather the IP address from the victim's machine.[1] |
|
| .001 | Internet Connection Discovery |
More_eggs has used HTTP GET requests to check internet connectivity.[2] |
||
| Enterprise | T1518 | .001 | 软件发现: Security Software Discovery |
More_eggs can obtain information on installed anti-malware programs.[1] |
| Enterprise | T1105 | 输入工具传输 |
More_eggs can download and launch additional payloads.[1][2] |
|
| Enterprise | T1553 | .002 | 颠覆信任控制: Code Signing |
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.[2] |