ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool IcedCoffee

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: IcedCoffee

NamesIcedCoffee
CategoryMalware
TypeReconnaissance, Backdoor
Description(Kaspersky) IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server. IcedCoffee has no built-in command capability, instead it may receive javascript files from the C2 server, which are deobfuscated and executed in memory, leaving nothing behind on disk for forensic analysis. IcedCoffee was not widely deployed, rather it was targeted at diplomats, including Ambassadors, of European governments.
Information<https://securelist.com/shedding-skin-turlas-fresh-faces/88069/>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:icedcoffee>

Last change to this tool card: 20 April 2020

Download this tool card in JSON format

Previous: IceCube
Next: Icefog

All groups using tool IcedCoffee

ChangedNameCountryObserved

APT groups

XTurla, Waterbug, Venomous BearRussia1996-Jun 2020 

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key