Introducing DevOpt: A Multifunctional Backdoor Arsenal

MITRE Techniques

• [T1547.001] Startup Items – Persistence by placing copies in Startup folder to auto-start on boot. “the malware replicated itself in the Startup folder, enabling it to initiate automatically whenever the computer is powered on.”
• [T1027] Obfuscated Files or Information – The newer variant uses encoded integer-based strings for its functionality. “newer variant uses encoded integer-based strings for its functionality.”
• [T1037.005] Registry Run Keys / Startup Folder – Persistence via Startup directory path. “Startup directory path.”
• [T1082] System Information Discovery – The config file exposes OS name, Device_ID, Version. “The configuration file Winkeyjet.ini contains information about the compromised system, such as the name of the operating system, a unique Device_ID, and the version number.”
• [T1057] Process Discovery – The malware can enumerate processes. “Command to collect the Process list of infected systems.”
• [T1083] File and Directory Discovery – The DIR command collects file information (name, directory, size, modified date). “Command to collect file information of the given directory. It can collect file name, directory name, size and modified date.”
• [T1115] Clipboard Data – Clipper steals clipboard data. “Clipper malware … record the clipboard data” and “logs all the information copied to the clipboard.”
• [T1056.001] Keylogging – Keystrokes are captured and logged. “Keylogger malware is specifically designed to capture every keystroke made by a user” and “Kebba.dan … log the keystrokes.”
• [T1005] Data from Local System – Data exfiltration of credentials and sensitive data. “stealer … pilfer sensitive information” and browser data described in detail.
• [T1555.003] Credentials from Web Browsers – Chrome/Yandex data stolen (cookies, history, login data). “Chrome browser data collected” and “Ya Passman Data” equivalents are listed.
• [T1539] Steal Web Session Cookie – Browser session data theft indicated by browser data collection. “Web Browser Data” mentions cookies/history.
• [T1095] Non-Application Layer Protocol – C2 over network; initial create request and 200 OK response. “establishing a connection with the Command and Control (CnC) starts with the malware sending a “create” request. … CnC responds with a “200 OK” message.”
• [T1071] Application Layer Protocol – C2 communications via domain and HTTP-based protocols. “Command and Control domain” referenced alongside data exfiltration patterns.