Skip to content
MalwareWiki

Malware

LOWBALL

LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server.

LOWBALL is a Windows malware family operated by Temper Panda.

Background

LOWBALL repurposes the legitimate Dropbox cloud-storage service as its CnC server. Authenticating to the Dropbox API with a hardcoded bearer access token, it can download, upload, and execute files. All of its traffic runs over HTTPS on port 443.

Source: Malpedia (Fraunhofer FKIE).