mirror of https://github.com/MISP/misp-galaxy
47 lines
2.8 KiB
JSON
47 lines
2.8 KiB
JSON
{
|
|
"authors": [
|
|
"raw-data"
|
|
],
|
|
"description": "A list of backdoor malware.",
|
|
"name": "Backdoor",
|
|
"source": "Open Sources",
|
|
"type": "backdoor",
|
|
"uuid": "75436e27-cb57-4f32-bf1d-9636dd78a2bf",
|
|
"values": [
|
|
{
|
|
"description": "Cross-platform malware written in Golang, compatible with Linux and Windows. Although there are some minor differences, both variants have the same functionality. The malware communicates with a CnC server using HTTP requests and performs functions based on the received commands. Results of command execution are sent in HTTP POST requests data (RSA-encrypted). Main functionalities are: (1) Execute arbitrary shell commands, (2) Upload/Download files. The PE variant of the infection, in addition, executes PowerShell scripts. A .Net version was also observed in the wild.",
|
|
"meta": {
|
|
"date": "July 2018.",
|
|
"refs": [
|
|
"https://blog.jpcert.or.jp/2018/07/malware-wellmes-9b78.html"
|
|
]
|
|
},
|
|
"related": [
|
|
{
|
|
"dest-uuid": "d84ebd91-58f6-459f-96a1-d028a1719914",
|
|
"tags": [
|
|
"estimative-language:likelihood-probability=\"likely\""
|
|
],
|
|
"type": "similar"
|
|
}
|
|
],
|
|
"uuid": "e0e79fab-0f1d-4fc2-b424-208cb019a9cd",
|
|
"value": "WellMess"
|
|
},
|
|
{
|
|
"description": "The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU. It is enabled by a model-specific-register control bit, and then toggled with a launch-instruction. The embedded core is then fed commands, wrapped in a specially formatted x86 instruction. The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks.\n\nWhile the backdoor should require kernel level access to activate, it has been observed to be enabled by default on some systems, allowing any unprivileged code to modify the kernel.\n\nThe rosenbridge backdoor is entirely distinct from other publicly known coprocessors on x86 CPUs, such as the Management Engine or Platform Security Processor; it is more deeply embedded than any known coprocessor, having access to not only all of the CPU's memory, but its register file and execution pipeline as well.",
|
|
"meta": {
|
|
"date": "August 2018",
|
|
"refs": [
|
|
"https://www.bleepingcomputer.com/news/security/backdoor-mechanism-discovered-in-via-c3-x86-processors/",
|
|
"https://github.com/xoreaxeaxeax/rosenbridge",
|
|
"https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Christopher%20Domas/DEFCON-26-Christopher-Domas-GOD-MODE-%20UNLOCKED-hardware-backdoors-in-x86-CPUs.pdf"
|
|
]
|
|
},
|
|
"uuid": "2bb165dc-9f93-11e8-ae64-d3dbab0dd786",
|
|
"value": "Rosenbridge"
|
|
}
|
|
],
|
|
"version": 3
|
|
}
|