IRAFAU
Description
(Fortinet) The backdoor, which we now call “IRAFAU” from a decrypted string found during analysis, comes as a file packed with what looks to be modified UPX. Regardless, unpacking it is simple.
Once unpacked, the backdoor malware’s behavior was not obvious because its strings were still encrypted and APIs used had been dynamically imported.
So, the first thing this malware does is to initialize a structure where it stores the decrypted strings that will be used in the next function calls. This includes the command and control server string, function pointers, and dynamically imported APIs that will be used throughout its execution. This structure is passed as a parameter to subsequent functions.
Names
| Name |
|---|
| IRAFAU |
Category
Malware
Type
- Backdoor
Information
Other Information
Uuid
5401d405-232f-4c64-ad31-4d30274bd90f
Last Card Change
2022-12-27