Procedure examples

Backdoor.Oldrea collects information about the Internet adapter configuration.

Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.

Backdoor.Oldrea collects the current username from the victim.

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

Backdoor.Oldrea injects itself into explorer.exe.

Backdoor.Oldrea collects information about running processes.

Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.

Backdoor.Oldrea collects information about the OS and computer name.

Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.

Backdoor.Oldrea collects address book information from Outlook.

Backdoor.Oldrea can download additional modules from C2.

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Backdoor.Oldrea adds Registry Run keys to achieve persistence.

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.