OtterCandy Propose Change

OtterCandy is a modular JavaScript backdoor that combines features from earlier malware families like OtterCookie and RATatouille (aka INVISIBLEFERRET.JAVASCRIPT). It steals sensitive information including browser credentials and cryptocurrency wallet data, and can execute commands like uploading files, changing directories, and self-termination. The malware communicates via socket.io protocol over port 5000 to receive and execute commands from attackers.

References

There is no Yara-Signature yet.