Snugy
Description
(Palo Alto) The OfficeIntegrator.ps1 file seen in the ResolutionHosts task is a PowerShell-based backdoor we call Snugy, which allows an actor to obtain the system’s hostname and to run commands. Snugy is a variant of the CASHY200 backdoor used by actors in previous attacks in the xHunt campaign. In July 2019, Trend Micro created a detection signature for this backdoor called Backdoor.PS1.NETERO.A, which suggests that this particular variant of CASHY200 has been around for over a year. We are calling this variant of the backdoor Snugy, as Netero is already a name of a variant of the Hisoka tool used by the xHunt actors.
Names
| Name |
|---|
| Snugy |
Category
Malware
Type
- Backdoor
- Tunneling
Information
Malpedia
Other Information
Uuid
496a74e7-daf3-4672-b9e1-82209f8dd487
Last Card Change
2022-12-29