Backdoor.Win64.COBEACON.FARC

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute arbitrary code
• Inject code into processes
• Manage services
• Manage processes
• Manage files/directories
• Manage named pipes
• Manage environment variables
• List logical drives
• List registry entries
• List IP addresses
• Impersonate user tokens

It connects to the following websites to send and receive information:

• http://{Random numbers}.ns2.{BLOCKED}s.club/_/scs/mail-static/_/js/
• http://{Random numbers}.ns2.{BLOCKED}s.club/mail/u/0

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

Upon execution of the affected application, it gathers the following information:

• User name
• Computer name
• OS version
• Host name
• IP address
• Current process ID

Other Details

This Backdoor does the following:

• It appends the following to the requests as additional header:
  • Cookie: OSID={Encoded stolen information}

It does not exploit any vulnerability.