Also known as: PHOTO, Derusbi, HIGHNOON, Rbdoor, Photo, Shyape, Sakula (variant), Mivast
No AI analysis yet.
A DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files. Attributed to: APT41, APT17, Leviathan, Stone Panda.