HDoor

Description

(Kaspersky) The Naikon APT frequently used a custom backdoor that appears to be an HDoor variant, based on old “Honker Union” code like “hscan v120”. For example, once on a victim network, one of the first steps is to run the hdoor -hbs scan to identify target local network hosts.

The Naikon APT’s custom-built HDoor tool is a robust reconnaissance tool for lateral movement, supporting the identification of, interfacing with and attacking of multiple technologies and resources: • host, user, group, and related authentication resources and cracking/brute forcing capabilities • network asset scanning and identification, including SQL database, embedded network devices like home or SMB routers, and other common network services • fake service listener to sniff traffic • disk wiping – safe delete with multiple overwrites • process management • local filetime modifier • SQL administration toolset • SOCKS5 proxy service • banner-based scanner • AV killer

Names

Name
HDoor
Custom HDoor

Category

Malware

Type

• Reconnaissance
• Backdoor
• Info stealer
• Wiper
• Tunneling

Information

• https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf
• https://securelist.com/cycldek-bridging-the-air-gap/97157/

Mitre Attack

• https://attack.mitre.org/software/S0061/

Other Information

Uuid

69ede5dc-4d7a-4ae5-8469-e4d93f62b2a6

Last Card Change

2022-12-30