PLUGGYAPE Propose Change

Actor(s): Void Blizzard

According to CERT-UA, this malware establishes a connection to the management server using web sockets and/or MQTT, data is transmitted in JSON format. Based on basic information about the computer (MAC address, BIOS serial number, disk and processor ID), it generates a unique device identifier using the SHA-256 algorithm (the first 16 bytes are used). It ensures the execution of the program code received from the server. Persistence is achieved by creating an entry in the Run branch of the operating system registry.

References

There is no Yara-Signature yet.