Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak

guest · Dec 13, 2018

Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak
December 13, 2018
https://blog.trendmicro.com/trendla...ear-old-implant-from-the-shadow-brokers-leak/

What stands out from all of those implants is a standalone executable that has the file name clocksvc.exe, located in the main folder of ExpandingPulley (EP), \windows\Resources\Ep\. This implant has never received any public attention
[...] We named this implant Tildeb (detected by Trend Micro as Trojan.Win32.TILDEB.A) because of a unique temporary file that it creates on the system under the name ~debl00l.tmp.

Also of note are its multiple fatal programmatic mistakes throughout the code, the use of the mailslot mechanism for interprocess communications, and the level of attention it places on its internal operation as well as C&C communications to stay under the radar.
[...] some of the committed programmatic errors are fatal to the operation of the implant and breaks intended functionalities, while others are blatant mistakes.

Our technical brief provides detailed research into Tildeb’s inner workings — its C&C communications protocol, control commands, and fail-aware cleanup processes, among other features and capabilities.
Click to expand...

Technical brief (PDF): https://documents.trendmicro.com/assets/tech-brief-tildeb-analyzing-the-18-year-old-implant-from-the-shadow-brokers-leak.pdf

Log in or Sign up

Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak

guest Guest

Log in or Sign up

Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak

guest Guest

Useful Searches