LOWBALL
Description
(FireEye) This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files. The communication occurs via HTTPS over port 443.
Names
| Name |
|---|
| LOWBALL |
Category
Malware
Type
- Backdoor
- Exfiltration
Information
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
1cf868dc-4067-40c8-aaec-a47cfac9f37c
Last Card Change
2020-04-23