Skip to content

Malware

More_eggs

aka SpicyOmelette · SKID

More_eggs is a JavaScript backdoor used by the Cobalt group.

More_eggs, also known as SpicyOmelette, SKID, is a JavaScript malware family operated by Cobalt, FIN6 and others.

Background

More_eggs is a JavaScript backdoor leveraged by the Cobalt group. Once running, it reaches out to its C&C server to fetch commands to execute, including the following:

  • d&exec = download and execute PE file
  • gtfo = delete files/startup entries and terminate
  • more_eggs = download additional/new scripts
  • more_onion = run new script and terminate current script
  • more_power = run command shell commands

Source: Malpedia (Fraunhofer FKIE).