TSCookie

TSCookie is a malware that has been associated with various backdoors such as BendyBear, BIFROSE (Bifrost), Consock, KIVARS, PLEAD, XBOW, and Waterbear (DBGPRINT). It's also known as FakeDead and is used in conjunction with other tools like BendyBear and Flagpro by BlackTech, an advanced persistent threat group. The malware operates by exploiting Windows utilities, a technique referred to as "living off the land". TSCookie has been particularly active in conducting attacks against Japanese organizations using a variety of malware types. The structure of TSCookie consists of two main files: TSCookie Loader and TSCookie itself. The loader can be either in EXE or DLL format and is responsible for reading and executing specific files stored in the same folder or certain locations. TSCookie provides parameters such as Command & Control (C&C) server information when loading TSCookieRAT, a remote access tool. This RAT then executes functions based on commands sent from the C&C server. TSCookie communicates with its C&C servers using the HTTP protocol and downloads two key components: "a module" and "a loader" for loading this module. Once downloaded, TSCookie then initiates another module. The malware's activities are concealed within standard HTTP header payloads, making it harder to detect. It's important for organizations to ensure their devices aren't communicating with hosts associated with TSCookie, as listed in Appendix F, to prevent potential breaches.