VEILEDSIGNAL
Description
(Mandiant) SIGFLIP and DAVESHELL extract and execute a modular backdoor, VEILEDSIGNAL, and two corresponding modules. VEILEDSIGNAL relies on the two extracted modules for process injection and communications with the Command and Control (C2) server.
VEILEDSIGNAL and the accompanying two components provide the following functionality:
• The VEILEDSIGNAL backdoor supports three commands: send implant data, execute shellcode, and terminate itself. • The process injection module injects the C2 module in the first found process instance of Chrome, Firefox, or Edge. It also monitors the named pipe and reinjects the communication module if necessary. • The C2 module creates a Windows named pipe and listens for incoming communications, which it then sends to the C2 server encrypted with AES-256 in Galois Counter Mode (GCM).
Names
| Name |
|---|
| VEILEDSIGNAL |
Category
Malware
Type
- Backdoor
Information
Malpedia
Other Information
Uuid
a459f3f3-ccd1-40f9-96b3-f15763d2051e
Last Card Change
2023-10-13