In addition, the files drop and decode an Active Server Pages (ASPX) webshell. Five of the files drop and decode a reverse shell utility that can send and receive data and commands. One DLL file will attempt to collect the target system's Transmission Control Protocol (TCP) connection table, and exfiltrate it to a remote Command and Control server (C2). If the DLL contains a hardcoded Internet Protocol (IP) address, status messages will be sent to the IP. When 11 of the dynamic link library (DLL) files are loaded, the files can read, create, and delete files. Summary DescriptionĬISA received 18 files for analysis from a forensic analysis engagement conducted at a Federal Civilian Executive Branch (FCEB) agency. For more information on the Traffic Light Protocol (TLP), see.

Subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. This document is marked TLP:CLEAR-Disclosure is not limited. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. This report is provided 'as is' for informational purposes only.

Download comodo firewall only