Threat Group Cards: A Threat Actor Encyclopedia
Excerpt
Home > List all groups > List all tools > List all groups using tool Emdivi Tool: Emdivi
Names
Emdivi
Newsripper
Category Malware
Type Backdoor
Description
(Kaspersky) The emdivi family stores important data about itself, including C2, API name, strings for anti-analysis, value of mutexes, as well as the md5 checksum of backdoor commands and the internal proxy information. They are stored in encrypted form, and are decrypted when necessary. Therefore, to analyze an emdivi sample in detail, we need to locate which hex codes are encrypted, and how to decrypt them. In the process of decryption, a unique decryption key is required for each sample.
Information
Malpedia AlienVault OTX Last change to this tool card…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ETDA Threat Group Cards on apt.etda.or.th.
More from ETDA Threat Group Cards19
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 20 Oct
- listgroups.cgi?u=72670111-f95a-423c-a296-f424939cc08eETDA Threat Group Cards · Added 19 Oct
- listgroups.cgi?u=cacc4de8-a9b2-4231-9fdb-8aefa8ed0a5cETDA Threat Group Cards · Added 19 Oct
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
