ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool More_eggs

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: More_eggs

NamesMore_eggs
SpicyOmelette
Terra Loader
SKID
CategoryMalware
TypeBackdoor, Downloader
DescriptionMore_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are:
- d&exec = download and execute PE file
- gtfo = delete files/startup entries and terminate
- more_eggs = download additional/new scripts
- more_onion = run new script and terminate current script
- more_power = run command shell commands
Information<https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/>
<https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/>
<https://reaqta.com/2018/03/spear-phishing-campaign-leveraging-msxsl/>
<https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish>
<https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/>
<https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html>
<https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers>
<https://asert.arbornetworks.com/double-the-infection-double-the-fun/>
<https://quointelligence.eu/2018/11/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using/>
MITRE ATT&CK<https://attack.mitre.org/software/S0284/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/js.more_eggs>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:More_eggs>

Last change to this tool card: 10 July 2020

Download this tool card in JSON format

All groups using tool More_eggs

ChangedNameCountryObserved

APT groups

 Cobalt GroupRussia2016-Oct 2019X
 Evilnum[Unknown]2018-Aug 2020 
 FIN6, Skeleton Spider[Unknown]2015-Mar 2020 

Other groups

 Venom Spider, Golden ChickensRussia2017-Feb 2019 

4 groups listed (3 APT, 1 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key