ComeBacker (Malware Family)

ComeBacker

VTCollection

ComeBacker was found in a backdoored Visual Studio project that was used to target security researchers in Q4 2020 and early 2021.

It is an HTTP(S) downloader.

It uses the AES CBC cipher implemented through the OpenSSL's EVP interface for decryption of its configuration, and also for encryption and decryption of the client-server communication.

The parameter names in HTTP POST requests of the client are generated randomly. As the initial connection, the client exchanges the keys with the server via the Diffie–Hellman key agreement protocol for the elliptic curve secp521r1. The client generates a random 32-bytes long private key, and the server responds with its public key in a buffer starting with the wide character "0".

Next, the clients sends the current local time, and the server responds with a buffer containing multiple values separated with the pipe symbol. The typical values are the encrypted payload, the export to execute, and the MD5 hash of the decrypted DLL to verify the authenticity of the payload.

There are variants of ComeBacker without statically linked OpenSSL. In that case, the key exchange is omitted and AES CBC is replaced with HC-256.

References

2026-02-24 ⋅ Symantec ⋅ Threat Hunter Team
North Korean Lazarus Group Now Working With Medusa Ransomware
ComeBacker Medusa

2025-11-07 ⋅ ENKI ⋅ ENKI
Lazarus Group targets Aerospace and Defense with new Comebacker variant
ComeBacker

2025-10-30 ⋅ Gen Digital ⋅ Alexandru-Cristian Bardaș
DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant
ComeBacker DRATzarus NikiTeaR

2024-12-26 ⋅ ⋅ Weixin ⋅ 360 Threat Intelligence Center
Analysis of the attack activities of APT-C-26 (Lazarus) using weaponized IPMsg software
ComeBacker

2024-05-28 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks
ComeBacker splitloader

2023-11-10 ⋅ ⋅ HAURI ⋅ HAURI
Detailed analysis report: Malware disguised as Putty (Lazarus APT)
ComeBacker

2021-04-01 ⋅ AhnLab ⋅ ASEC Analysis Team
ASEC REPORT VOL.102 Q1 2021
ComeBacker JessieConTea LCPDot

2021-02-01 ⋅ One Night in Norfolk ⋅ Kevin Perlow
DPRK Targeting Researchers II: .Sys Payload and Registry Hunting
ComeBacker

2021-01-30 ⋅ ⋅ Microstep Intelligence Bureau ⋅ Microstep online research response team
Analysis of Lazarus attacks against security researchers
ComeBacker

2021-01-29 ⋅ ⋅ NSFOCUS ⋅ Fuying Laboratory
认识STUMBzarus——APT组织Lazarus近期定向攻击组件深入分析
ComeBacker DRATzarus Torisma

2021-01-28 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
ZINC attacks against security researchers
ComeBacker Klackring

2021-01-26 ⋅ One Night in Norfolk ⋅ Kevin Perlow
DPRK Malware Targeting Security Researchers
ComeBacker

2021-01-26 ⋅ Comae ⋅ Matt Suiche
PANDORABOX - North Koreans target security researchers
ComeBacker

2021-01-25 ⋅ Google ⋅ Adam Weidemann
New campaign targeting security researchers
ComeBacker DRATzarus

Yara Rules

[TLP:WHITE] win_comebacker_auto (20260917 | Detects win.comebacker.)

rule win_comebacker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.comebacker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6683f809 7f04 0430 eb02 }
            // n = 4, score = 500
            //   6683f809             | cmp                 ax, 9
            //   7f04                 | jg                  6
            //   0430                 | add                 al, 0x30
            //   eb02                 | jmp                 4

        $sequence_1 = { e8???????? e8???????? 8bf8 b867666666 }
            // n = 4, score = 400
            //   e8????????           |                     
            //   e8????????           |                     
            //   8bf8                 | dec                 eax
            //   b867666666           | mov                 eax, dword ptr [esp + 0x50]

        $sequence_2 = { 4889742440 e8???????? 488bf0 4885c0 0f84a3010000 488b4b08 }
            // n = 6, score = 400
            //   4889742440           | jne                 0x2e
            //   e8????????           |                     
            //   488bf0               | dec                 esp
            //   4885c0               | lea                 ecx, [0x3e8dc]
            //   0f84a3010000         | lea                 edx, [eax + 0x7b]
            //   488b4b08             | lea                 ecx, [eax + 6]

        $sequence_3 = { 4c8d054fb70300 41b93b020000 8d4aeb e8???????? b801000000 }
            // n = 5, score = 400
            //   4c8d054fb70300       | je                  0x1af
            //   41b93b020000         | dec                 eax
            //   8d4aeb               | mov                 ecx, dword ptr [ebx + 8]
            //   e8????????           |                     
            //   b801000000           | inc                 esp

        $sequence_4 = { 448bc6 442bc0 488b442450 488d0d57be0600 488b0cc1 44897c2444 }
            // n = 6, score = 400
            //   448bc6               | dec                 eax
            //   442bc0               | mov                 dword ptr [esp + 0x40], esi
            //   488b442450           | dec                 eax
            //   488d0d57be0600       | mov                 esi, eax
            //   488b0cc1             | dec                 eax
            //   44897c2444           | test                eax, eax

        $sequence_5 = { 498d4e07 448d4210 e8???????? 448be0 }
            // n = 4, score = 400
            //   498d4e07             | mov                 eax, esi
            //   448d4210             | inc                 esp
            //   e8????????           |                     
            //   448be0               | sub                 eax, eax

        $sequence_6 = { 48894370 4885c0 7529 4c8d0ddce80300 8d507b 8d4806 }
            // n = 6, score = 400
            //   48894370             | test                byte ptr [edx + 0x38], 0x80
            //   4885c0               | je                  0x2d
            //   7529                 | dec                 eax
            //   4c8d0ddce80300       | mov                 dword ptr [ebx + 0x70], eax
            //   8d507b               | dec                 eax
            //   8d4806               | test                eax, eax

        $sequence_7 = { 486bd258 490394c140480a00 f6423880 742b e8???????? }
            // n = 5, score = 400
            //   486bd258             | dec                 eax
            //   490394c140480a00     | imul                edx, edx, 0x58
            //   f6423880             | dec                 ecx
            //   742b                 | add                 edx, dword ptr [ecx + eax*8 + 0xa4840]
            //   e8????????           |                     

        $sequence_8 = { e8???????? 83c40c 8d8d8cf6ffff 51 8d55e8 52 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8d8d8cf6ffff         | lea                 ecx, [ebp - 0x974]
            //   51                   | push                ecx
            //   8d55e8               | lea                 edx, [ebp - 0x18]
            //   52                   | push                edx

        $sequence_9 = { 6aff 68???????? 6800020000 53 ff15???????? e8???????? 3bc3 }
            // n = 7, score = 100
            //   6aff                 | push                -1
            //   68????????           |                     
            //   6800020000           | push                0x200
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   e8????????           |                     
            //   3bc3                 | cmp                 eax, ebx

        $sequence_10 = { 6a00 6a00 8bf0 8d8570ffffff 6a00 50 e8???????? }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8bf0                 | mov                 esi, eax
            //   8d8570ffffff         | lea                 eax, [ebp - 0x90]
            //   6a00                 | push                0
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_11 = { 8944242c 8b1c9538500410 8b542414 c1ea18 }
            // n = 4, score = 100
            //   8944242c             | mov                 dword ptr [esp + 0x2c], eax
            //   8b1c9538500410       | mov                 ebx, dword ptr [edx*4 + 0x10045038]
            //   8b542414             | mov                 edx, dword ptr [esp + 0x14]
            //   c1ea18               | shr                 edx, 0x18

        $sequence_12 = { 83c43c 8903 5f 8bc6 33cd 5e }
            // n = 6, score = 100
            //   83c43c               | add                 esp, 0x3c
            //   8903                 | mov                 dword ptr [ebx], eax
            //   5f                   | pop                 edi
            //   8bc6                 | mov                 eax, esi
            //   33cd                 | xor                 ecx, ebp
            //   5e                   | pop                 esi

        $sequence_13 = { 03c0 8d9dc8f8ffff 8985c8f8ffff e8???????? 8bbdc8f8ffff 6802200300 }
            // n = 6, score = 100
            //   03c0                 | add                 eax, eax
            //   8d9dc8f8ffff         | lea                 ebx, [ebp - 0x738]
            //   8985c8f8ffff         | mov                 dword ptr [ebp - 0x738], eax
            //   e8????????           |                     
            //   8bbdc8f8ffff         | mov                 edi, dword ptr [ebp - 0x738]
            //   6802200300           | push                0x32002

        $sequence_14 = { 8b0485e01f0910 c644080401 57 e8???????? }
            // n = 4, score = 100
            //   8b0485e01f0910       | mov                 eax, dword ptr [eax*4 + 0x10091fe0]
            //   c644080401           | mov                 byte ptr [eax + ecx + 4], 1
            //   57                   | push                edi
            //   e8????????           |                     

    condition:
        7 of them and filesize < 1429504
}

Download all Yara Rules

ComeBacker Propose Change

References

Yara Rules

ComeBacker