Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Software
  3. WEBC2

WEBC2

WEBC2 is a family of backdoor malware used byAPT1 as early as July 2006.WEBC2 backdoors are designed to retrieve a webpage, with commands hidden in HTML comments or special tags, from a predetermined C2 server.[1][2]

ID: S0109
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Wes Hurd
Version: 2.0
Created: 31 May 2017
Last Modified: 26 December 2023
Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1059.003Command and Scripting Interpreter:Windows Command Shell

WEBC2 can open an interactive command shell.[2]

EnterpriseT1574.001Hijack Execution Flow:DLL

Variants ofWEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to%SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).[1]

EnterpriseT1105Ingress Tool Transfer

WEBC2 can download and execute a file.[2]

Groups That Use This Software

IDNameReferences
G0006APT1

[2]

References

×
[8]ページ先頭
©2009-2026 Movatter.jp