BUFFETLINE
Description
(US-CERT) This report looks at a full-featured beaconing implant. This sample uses PolarSSL for session authentication, but then utilizes a FakeTLS scheme for network encoding using a modified RC4 algorithm. It has the capability to download, upload, delete, and execute files; enable Windows CLI access; create and terminate processes; and perform target system enumeration.
Names
| Name |
|---|
| BUFFETLINE |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Downloader
- Exfiltration
Information
Malpedia
Alienvault Otx
Other Information
Uuid
346a101f-489c-4d64-994b-f12ff6b60a1a
Last Card Change
2021-04-24