MalwareExploits 2 CVEs

ACBackdoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2018-8174Double Kill

Researchers have discovered a new multi-platform backdoor that infects Windows and Linux systems allowing the attackers to run malicious code and binaries on the compromised machines. The malware dubbed ACBackdoor is developed by a threat group with experience in developing malicious tools for the Linux platform.

via bleeping computerbleepingcomputer.com

CVE-2018-15982Adobe Flash Player Use-After-Free Remote Code Execution

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

the Windows version is being pushed through malvertising with the help of the Fallout Exploit Kit

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

the Windows version is being pushed through malvertising with the help of the Fallout Exploit Kit... targets the CVE-2018-15982 and the CVE-2018-8174 vulnerabilities to infect visitors of attacker-controlled sites with malware

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

ACBackdoor provides arbitrary execution of shell commands... allowing its operators to run shell commands

T1203Exploitation for Client ExecutionEvidence1

The latest version of this exploit kit... targets the CVE-2018-15982 (Flash Player) and the CVE-2018-8174 (Microsoft Internet Explorer VBScript Engine) vulnerabilities to infect visitors of attacker-controlled sites with malware.

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

create several symbolic links as well as an initrd script on Linux to gain persistence and get automatically launched on system startup

T1547.001Registry Run Keys / Startup FolderEvidence1

ACBackdoor will add a registry entry on Windows... to gain persistence and get automatically launched on system startup

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

create several symbolic links as well as an initrd script on Linux to gain persistence and get automatically launched on system startup

T1055Process InjectionEvidence1

additional features not seen in the Windows version such as independent process creation and process renaming

T1547.001Registry Run Keys / Startup FolderEvidence1

ACBackdoor will add a registry entry on Windows... to gain persistence and get automatically launched on system startup

Stealth

2 techniques

T1036MasqueradingEvidence1

The backdoor will also attempt to camouflage itself as MsMpEng.exe... while on Linux it will disguise as the Ubuntu UpdateNotifier utility and will rename its process to [kworker/u8:7-ev]

T1055Process InjectionEvidence1

additional features not seen in the Windows version such as independent process creation and process renaming

Discovery

1 technique

T1082System Information DiscoveryEvidence1

the malware will start collecting system information including its architecture and MAC address, using platform-specific tools to do it

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

To communicate with its C2 server, both malware variants use Hypertext Transfer Protocol Secure (HTTPS) as a communication channel

T1105Ingress Tool TransferEvidence1

allowing its operators... to execute a binary, and to update the malware on the infected system

T1132Data EncodingEvidence1

with all the collected information being sent as a BASE64 encoded payload

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Nov 18, 2019

Linux, Windows Users Targeted With New ACBackdoor Malware

A multi-platform backdoor targeting Windows and Linux that provides arbitrary shell command execution, arbitrary binary execution, persistence, update capability, system information collection, and HTTPS-based C2 communications. The Linux variant is described as more complex, with additional features such as independent process creation and process renaming.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

ACBackdoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2018-8174Double Kill

via bleeping computerbleepingcomputer.com

CVE-2018-15982Adobe Flash Player Use-After-Free Remote Code Execution

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

the Windows version is being pushed through malvertising with the help of the Fallout Exploit Kit

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

ACBackdoor provides arbitrary execution of shell commands... allowing its operators to run shell commands

T1203Exploitation for Client ExecutionEvidence1

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

create several symbolic links as well as an initrd script on Linux to gain persistence and get automatically launched on system startup

T1547.001Registry Run Keys / Startup FolderEvidence1

ACBackdoor will add a registry entry on Windows... to gain persistence and get automatically launched on system startup

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

create several symbolic links as well as an initrd script on Linux to gain persistence and get automatically launched on system startup

T1055Process InjectionEvidence1

additional features not seen in the Windows version such as independent process creation and process renaming

T1547.001Registry Run Keys / Startup FolderEvidence1

ACBackdoor will add a registry entry on Windows... to gain persistence and get automatically launched on system startup

Stealth

2 techniques

T1036MasqueradingEvidence1

The backdoor will also attempt to camouflage itself as MsMpEng.exe... while on Linux it will disguise as the Ubuntu UpdateNotifier utility and will rename its process to [kworker/u8:7-ev]

T1055Process InjectionEvidence1

additional features not seen in the Windows version such as independent process creation and process renaming

Discovery

1 technique

T1082System Information DiscoveryEvidence1

the malware will start collecting system information including its architecture and MAC address, using platform-specific tools to do it

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

To communicate with its C2 server, both malware variants use Hypertext Transfer Protocol Secure (HTTPS) as a communication channel

T1105Ingress Tool TransferEvidence1

allowing its operators... to execute a binary, and to update the malware on the infected system

T1132Data EncodingEvidence1

with all the collected information being sent as a BASE64 encoded payload

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

bleeping computerNews

Nov 18, 2019

Linux, Windows Users Targeted With New ACBackdoor Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.