DEADEYE
Description
(FireEye) Tracking APT41 activities over the past months, we observed multiple samples that shared two unique features: the use of RC5 encryption which we don’t encounter often, and a unique string “f@Ukd!rCto R$.”. We track these samples as DEADEYE.
DEADEYE comes in multiple variants: • DEADEYE.DOWN has the capability to download additional payloads. • DEADEYE.APPEND has additional payloads appended to it. • DEADEYE.EXT loads payloads that are already present on the system.
Names
| Name |
|---|
| DEADEYE |
| DEADEYE.EMBED |
| DEADEYE.APPEND |
Category
Malware
Type
- Downloader
Information
Mitre Attack
Other Information
Uuid
ef5ffed4-c004-4742-9648-679ad06b6f31
Last Card Change
2024-01-17