ComeBacker
- First seen
- 2020-10-01 00:00:00
- Malware type
- downloader, backdoor
- Profile updated
- 2026-07-07 13:19:30
Targeted industries: technology-and-telecommunications government-and-public-sector
Context
ComeBacker was found in a backdoored Visual Studio project that was used to target security researchers in Q4 2020 and early 2021. It is an HTTP(S) downloader. It uses the AES CBC cipher implemented through the OpenSSL's EVP interface for decryption of its configuration, and also for encryption and decryption of the client-server communication. The parameter names in HTTP POST requests of the client are generated randomly. As the initial connection, the client exchanges the keys with the server via the Diffie–Hellman key agreement protocol for the elliptic curve secp521r1. The client generates a random 32-bytes long private key, and the server responds with its public key in a buffer starting with the wide character "0". Next, the clients sends the current local time, and the server responds with a buffer containing multiple values separated with the pipe symbol. The typical values are the encrypted payload, the export to execute, and the MD5 hash of the decrypted DLL to verify the authenticity of the payload. There are variants of ComeBacker without statically linked OpenSSL. In that case, the key exchange is omitted and AES CBC is replaced with HC-256.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Comebacker_Auto (yara-rule)
Reports & references
- Microsoft — Moonstone Sleet Emerges As New North Korean Threat Actor With New Bag Of Tricks (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Comebacker (report)
- blog.nsfocus.net — Stumbzarus Apt Lazarus (report)
- blog.google — New Campaign Targeting Security Researchers (report)
- enki.co.kr — Lazarus Group Targets Aerospace And Defense With New Comebacker Variant (report)
- anquanke.com — 230161 (report)
- norfolkinfosec.com — Dprk Targeting Researchers Ii Sys Payload And Registry Hunting (report)
- download.hauri.net — Dwn Detail Down (report)
- norfolkinfosec.com — Dprk Malware Targeting Security Researchers (report)
- security.com — Lazarus Medusa Ransomware (report)
- comae.com — Pandorabox North Koreans Target Security Researchers (report)
- cn.ahnlab.com — Asec%20Report Vol.102 Eng%20(4) (report)
- Microsoft — Zinc Attacks Against Security Researchers (report)
- mp.weixin.qq.com — S (report)
- gendigital.com — Dprk Kimsuky Lazarus Analysis (report)