TONEDEAF 2.0
Description
(Intezer) At first glance, “Client update.exe” seems like a completely new backdoor malware. However, further examination reveals it’s most likely a highly modified version of the previously seen TONEDEAF backdoor. TONEDEAF is a backdoor that communicates with its Command and Control server via HTTP in order to receive and execute commands. It was mentioned in FireEye’s recent report about an ongoing APT34 operation, as one of the group’s custom tools. We have named the new variant TONEDEAF 2.0.
TONEDEAF 2.0 is an advanced version of TONEDEAF, serving the same purpose as the original, but with a revamped C2 communication protocol and a substantially modified code base. In contrast to the original TONEDEAF, TONEDEAF 2.0 contains solely arbitrary shell execution capabilities, and doesn’t support any predefined commands. It’s also more stealthy and contains new tricks such as dynamic importing, string decoding, and a victim deception method.
Names
| Name |
|---|
| TONEDEAF 2.0 |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Tunneling
- Info stealer
- Exfiltration
Information
Other Information
Uuid
23cf2c05-faff-48b6-91af-4fc9158edbec
Last Card Change
2020-04-20