Unidentified 080
- Malware type
- trojan, rat
- Profile updated
- 2026-07-07 12:37:08
Targeted industries: government-and-public-sector technology-and-telecommunications financial-services
Context
This Trojan is a full-featured RAT capable of executing common tasks such as command execution and downloading/uploading files. This is implemented through a couple dozen C++ classes such as CMFile, CMFile, CMProcess, TFileDownload, TDrive, TProcessInfo, TSock, etc. The first stage custom installer utilizes the same classes. The Trojan uses HTTP Server API to filter HTTPS packets at port 443 and parse commands. It is also used by attackers to gather a target’s data, make lateral movements and create SOCKS tunnels to their C2 using the Earthworm tunneler.Given that the Trojan is an HTTPS server itself, the SOCKS tunnel is used for targets without an external IP, so the C2 is able to send commands.
Reports & references
- Kaspersky — 87914 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Unidentified 080 (report)