Backdoor.Win64.MRSADOOR.ZJME.enc

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

However, as of this writing, the said sites are inaccessible.

Otros detalles

Hace lo siguiente:

• It requires to be decrypted and loaded by a specific file in order to proceed with its intended routine.
• It requires to be in the following directory with a specific filename:
  • %Program Files%\Common Files\Microsoft Shared\ink\mraut.inc
• It requires the following file in order to proceed with its communication to C2 server:
  • %Program Files%\Common Files\System\msadc\msdfmap.dat → detected as Backdoor.Win64.MRSADOOR.A
    • contains an encrypted C2 server addresses

(Nota: %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).