GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia

Table of Contents GhostContainer: the backdoor Stub: C2 parser and dispatcher App_Web_843e75cf5b63: virtual page injector App_Web_8c9b251fb5b3: web proxy StrUtils: string and XML format processing class Infrastructure Victims Attribution Conclusions Indicators of compromise GReAT In a recent incident response (IR) case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the...