MeowBackConn Propose Change

MeowBackConn is a Go backdoor and traffic relay built as a c-shared Windows DLL and entered through an exported function. A named mutex enforces a single instance, after which the implant performs host and privilege reconnaissance by shelling out to cmd.exe and powershell.exe, then POSTs the results in cleartext to a hardcoded C2 server on a non-standard port. The reply supplies a port for a second channel: the implant establishes a raw TCP connection back to the same host and serves an HTTP CONNECT proxy, spawning one goroutine per connection to give the operator a pivot into the network. The same channel carries a minimal command set—self-deletion and an operator-defined dormancy period after which the implant relaunches—while a background goroutine re-beacons at a fixed interval. Its export, mutex, and command tokens share a "meow" naming theme that persists even if individual addresses change. The implant establishes no persistence, drops no files, and encrypts nothing; with its capabilities drawn entirely from the Go standard library, the mutex and its cleartext network traffic constitute the primary detection surface.

References

There is no Yara-Signature yet.