Backdoor.PHP.NODESNAKE.THAEBE

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• cmd.exe /s /c "powershell -c "tasklist /svc /FO CSV | ConvertFrom-Csv | ConvertTo-Json""
• cmd.exe /s /c "powershell -c "Get-Service | Select-Object -Property Name, DisplayName | ConvertTo-Json""
• cmd.exe /s /c "powershell -c "Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.State -ne 'Permanent' } | Select-Object @{Name='Interface'; Expression={$_.InterfaceAlias}}, @{Name='Internet Address'; Expression={$_.IPAddress}}, @{Name='Physical Address'; Expression={$_.LinkLayerAddress}}, @{Name='Type'; Expression={'dynamic'}} | ConvertTo-Json""
• cmd.exe /s /c "powershell -c "Get-PSDrive -PSProvider FileSystem | ConvertTo-Json""

Download Routine

This Backdoor connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}s.org/dist/v21.7.3/node-v21.7.3-win-x64.zip
• http://{BLOCKED}s.org/dist/v21.7.3/node-v21.7.3-win-x64.zip

Information Theft

This Backdoor gathers the following data:

• Services
• Network neighbors
• Drive information
• System Information

Other Details

This Backdoor accepts the following parameters:

• EXE → It downloads a Windows executable file (.exe), saves it to a temporary folder, and runs it.
• DLL → It downloads a dynamic-link library (.dll) and executes it using the Windows tool rundll32.exe.
• JS → It downloads a JS file in %Application Data% folder
• AUTORUN → It sets itself up for persistence.
• CMD → It executes any shell command the attacker sends, giving them a remote command prompt on the victim's machine.
• OFF → It shuts itself down.

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)