Skip to content
MalwareWiki

Malware

More_eggs

aka SpicyOmelette · SKID

More_eggs is a JavaScript backdoor used by the Cobalt group.

More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are:

  • d&exec = download and execute PE file
  • gtfo = delete files/startup entries and terminate
  • more_eggs = download additional/new scripts
  • more_onion = run new script and terminate current script
  • more_power = run command shell commands

Family metadata imported from Malpedia (Fraunhofer FKIE).