Malware
More_eggs
aka SpicyOmelette · SKID
More_eggs is a JavaScript backdoor used by the Cobalt group.
More_eggs, also known as SpicyOmelette, SKID, is a JavaScript malware family operated by Cobalt, FIN6 and others.
Background
More_eggs is a JavaScript backdoor leveraged by the Cobalt group. Once running, it reaches out to its C&C server to fetch commands to execute, including the following:
- d&exec = download and execute PE file
- gtfo = delete files/startup entries and terminate
- more_eggs = download additional/new scripts
- more_onion = run new script and terminate current script
- more_power = run command shell commands
Source: Malpedia (Fraunhofer FKIE).