DoubleFeature
Description
(Check Point) To better understand the above structure and flow, we focused our research on a component of DanderSpritz named Doublefeature (or Df for short). According to its own internal documentation, this plugin “Generates a log & report about the types of tools that could be deployed on the target”; a lot of the framework tools, in their own internal documentation, make the chilling claim that DoubleFeature is the only way to confirm their existence on a compromised system. After some pause, we figured that at least this means DoubleFeature could be used as a sort of Rosetta Stone for better understanding DanderSpritz modules, and systems compromised by them. DoubleFeature effectively, well, doubles as a diagnostic tool for victim machines carrying DanderSpritz — It’s an incident response team’s pipe dream.
Names
| Name |
|---|
| DoubleFeature |
Category
Malware
Type
- Reconnaissance
Information
Other Information
Uuid
a3223c7e-a8ba-4776-922a-ffdf1f1ec4fe
Last Card Change
2022-01-25