Trusted Design

WARP (FAMILY)

概要

The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain. Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html. The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com. It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp. When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'. The version signature information of the duplicate executable is zeroed out. Some WARP variants maintain persistence through the use of DLL search order hijacking.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• When ELF.BillGates met Windows (score: 0.65)
• WEBC2-CLOVER (FAMILY) (score: 0.63)
• PWS:Win32/Tamenoc (score: 0.62)
• VirTool:Win32/Fcrypter (score: 0.62)
• Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.62)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る