BACKSPACE

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

Adversaries can direct BACKSPACE to upload files to the C2 Server.

BACKSPACE may collect information about running processes.

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

BACKSPACE uses HTTP as a transport to communicate with its command server.

During its initial execution, BACKSPACE extracts operating system information from the infected host.

BACKSPACE allows adversaries to search for files.

The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.

BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.

Newer variants of BACKSPACE will encode C2 communications with a custom system.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.