원본 언어로만 콘텐츠 제공
class="post-article">
Loader C/C++ 2024년부터 활동

FTPInjectorLoader

Generic FTP+HTTP dual-channel loader/injector PE32 x86. VirtualAllocEx + WriteProcessMemory for process injection. FtpOpenFileW + FtpGetFileSize for FTP payload download. HttpSendRequest for HTTP C2. CryptAcquireContextA + CryptCreateHash + XOR for payload encryption. AdjustTokenPrivileges for privilege escalation. No cleartext C2 IOCs (encrypted).

위협 프로필
유형 Loader
프로그래밍 언어C/C++
C2 프로토콜FTP/HTTP
첫 감지2024
대상 Kuresel
목적 / 기능
  • Loader/Injector
이 패밀리에 대해 아직 확인된 C2 서버가 없습니다.

연구 보고서 (1)

Orta

FTPInjectorLoader 00f01750 -- VirtualAllocEx WriteProcessMemory Process Injection FtpOpenFileW HTTP InternetSendRequest XOR CryptAcquireContextA AdjustTokenPrivileges | Orta

FTPInjectorLoader 00f01750 PE32 GUI x86 1.4MB. VirtualAllocEx WriteProcessMemory process injection. FtpOpenFileW FtpGetFileSize FTP kanal. HttpSendRequest HTTP. XOR + CryptAcquireContextA.

보고서 읽기 →