IcedCoffee
Description
(Kaspersky) IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server. IcedCoffee has no built-in command capability, instead it may receive javascript files from the C2 server, which are deobfuscated and executed in memory, leaving nothing behind on disk for forensic analysis. IcedCoffee was not widely deployed, rather it was targeted at diplomats, including Ambassadors, of European governments.
Names
| Name |
|---|
| IcedCoffee |
Category
Malware
Type
- Reconnaissance
- Backdoor
Information
Alienvault Otx
Other Information
Uuid
7576109c-8a9f-49eb-9f4f-bb382535bcf5
Last Card Change
2020-04-20