Leash
Description
(Palo Alto) The Magic Hound campaign was also discovered deploying an IRC Bot, which we have named MagicHound.Leash. We discovered this connection when we observed a DropIt sample installing a backdoor Trojan that used IRC for its C2 communications.
Leash obtains its commands via private messages (PRIVMSG) sent from the adversary who must also be connected to the IRC server. All of its available commands (see Appendix), except for the VER command seen in Figure 5, must be issued by individuals in the IRC channel with nicknames that start with “AS_” or “AF_”.
Names
| Name |
|---|
| Leash |
Category
Malware
Type
- Backdoor
Information
Malpedia
Other Information
Uuid
cffb6ef7-2c27-43b6-87b8-a95d1b51fe75
Last Card Change
2020-04-23