ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > List all tools > List all groups using tool WebC2

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WebC2

NamesWebC2
WebC2-AdSpace
WebC2-Ausov
WebC2-Bolid
WebC2-Cson
WebC2-DIV
WebC2-GreenCat
WebC2-Head
WebC2-Kt3
WebC2-Qbp
WebC2-Rave
WebC2-Table
WebC2-UGX
WebC2-Yahoo
CategoryMalware
TypeBackdoor, Downloader
DescriptionA WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.
Information<http://contagiodump.blogspot.com/2013/03/mandiant-apt1-samples-categorized-by.html>
MITRE ATT&CK<https://attack.mitre.org/software/S0109/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo>

Last change to this tool card: 23 April 2020

Download this tool card in JSON format

Previous: WebBrowserPassView
Next: Webmask

All groups using tool WebC2

ChangedNameCountryObserved

APT groups

 Comment Crew, APT 1China2006-May 2018X

1 group listed (1 APT, 0 other, 0 unknown)

↑

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents
Telephone +66 (0)2-123-1227
E-mail [email protected]