Backdoor.Python.AXIOSRAT.THCCABF

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• kill - Terminates the backdoor process
• peinject - Drops a base64-decoded binary payload to /tmp and executes it
• runscript - Executes a base64-decoded arbitrary shell command
• rundir - Enumerates and returns the contents of specified directories with file metadata

Dropping Routine

This Backdoor drops the following files:

• /tmp/.{random 6 characters} - dropped binary payload received from C2 server

Information Theft

This Backdoor gathers the following data:

• System Information:
  • CPU architecture (x86_64, ARM, or unknown)
  • Hostname
  • Username
  • Operating system version
  • Timezone
  • Operating system installation date
  • System boot time
  • Current system time
  • Hardware manufacturer
  • Hardware product name
  • Full process list with PID, PPID, username, start time, and command line
• Directory Listings:
  • Home directory (~/)
  • Configuration directory (~/.config)
  • Documents directory (~/Documents)
  • Desktop directory (~/Desktop)

Other Details

This Backdoor accepts the following parameters:

• The C2 Server URL that it will use