Backdoor.Win64.JAMCAG.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• UPFILE → It is used to upload files from the infected system to a remote server
• DOWNFILE → It is used to download files from a remote server

Otros detalles

Hace lo siguiente:

• It requires to be executed as a service.
• It establishes a service named 'CheckUpdateService' and connects it to the system's service manager, ensuring the malicious service runs in the background and performs its tasks.
• It creates a TCP socket and listens for incoming connections by binding it to the following port:
  • 49834