Skip to content
MalwareWiki

Malware

Sagerunex

According to Symantec, Sagerunex is a backdoor that is fairly resilient and implements multiple forms of communication with its command-and-control (C&C) server.

Sagerunex is a Windows malware family operated by LOTUS PANDA.

Background

Per Symantec, Sagerunex is a robust backdoor that offers several ways to talk to its command-and-control (C&C) server. It stores its logs in encrypted form, applying AES256-CBC with a key derived through 8192 rounds of SHA256 from a hardcoded value. The malware is proxy-aware and supports multiple HTTP-based communication modes.

Source: Malpedia (Fraunhofer FKIE).