RocketMan
Description
(Kaspersky) We call this Trojan RocketMan after the string the developer uses for beaconing. Another string inside this malware is “TrumpTower”, used as an RC4 encryption initial vector.
This malware reads the C2 IP and port from the registry where it was saved by the previous stager. It processes the following commands from its C2 that are received encrypted over HTTP:
Names
| Name |
|---|
| RocketMan |
Category
Malware
Type
- Backdoor
Information
Other Information
Uuid
64c28fe2-1597-4b3a-b877-818e2687cd67
Last Card Change
2020-04-20