Backdoor.Win64.JAMCAG.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• UPFILE → It is used to upload files from the infected system to a remote server
• DOWNFILE → It is used to download files from a remote server

Andere Details

Es macht Folgendes:

• It requires to be executed as a service.
• It establishes a service named 'CheckUpdateService' and connects it to the system's service manager, ensuring the malicious service runs in the background and performs its tasks.
• It creates a TCP socket and listens for incoming connections by binding it to the following port:
  • 49834