BS2005
Description
(FireEye) Over the years, the Ke3chang attackers have used three types of malware that we call: “BS2005”, “BMW”, and “MyWeb”. We believe these three types of malware are an evolution of a single project from a single developer or small team of developers sharing code. Functionally, it is a typical first stage backdoor commonly found in APT attacks. It has the ability to upload and download files, run shell commands, and sleep for a configurable length of time. All of the CnC communications are performed over the HTTP protocol.
Names
| Name |
|---|
| BS2005 |
Category
Malware
Type
- Backdoor
- Info stealer
- Exfiltration
Information
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
34bcb564-8614-460b-9937-3a01f8d95637
Last Card Change
2020-05-13