FlowerPippi
Description
(Trend Micro) Some of FlowerPippi’s variants were packed by a custom packer —the same one that TA505 uses. The unpacked payload is written in C++ and works as backdoor or downloader malware. FlowerPippi doesn’t have an AutoRun function by itself; it is standalone and straightforwardly retrieves the payload.
FlowerPippi collects some of the user’s information, which it sends to the C&C server. When collecting information, FlowerPippi generates the victim ID from the system’s MAC address using the FNV-1a hash algorithm.
Names
| Name |
|---|
| FlowerPippi |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Downloader
Information
Other Information
Uuid
2c0f7f20-b2e6-44a6-8949-5fd6b08e3d92
Last Card Change
2020-04-20