PlugY

Description

(Kaspersky) Having analyzed the behavior of the newly found CloudSorcerer samples, we found that the attackers used it to download a previously unknown implant. This implant connects to the C2 server by one of three methods: • TCP protocol • UDP protocol • Named pipes

The set of commands this implant can handle is quite extensive, and implemented commands range from manipulating files and executing shell commands to logging keystrokes and monitoring the screen or the clipboard.

Names

Name
PlugY

Category

Malware

Type

  • Backdoor
  • Info stealer

Information

Other Information

Uuid

8ab930f9-1f09-41ce-912f-f95221973e88

Last Card Change

2024-08-27