TerraPreter
Description
(ESET) Evilnum group also uses 64-bit executables that decrypt and run a Meterpreter instance in memory. The use of Meterpreter gives them flexibility and the ability to run various payloads in a stealthy and extensible way.
The structure of these components and the integrity checks implemented were identified as TerraLoader (More_eggs) code. That’s why we refer to these components as TerraPreter.
Names
| Name |
|---|
| TerraPreter |
Category
Malware
Type
- Loader
Information
Malpedia
Other Information
Uuid
aa8a0c17-4f49-4a18-ac38-28e75a6f14b9
Last Card Change
2021-04-24