CORALDECK
Description
(FireEye) CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives.
Names
| Name |
|---|
| CORALDECK |
Category
Malware
Type
- Exfiltration
- Dropper
Information
Mitre Attack
Other Information
Uuid
bb2028cf-4303-4bc2-8dc7-3499f3d2f705
Last Card Change
2020-04-22