TEMPFUN

TEMPFUN is a backdoor Trojan that is unlikely to be used against regular users – the backdoor belongs to the arsenal of a high-level Advanced Persistent Threat (APT) hacking group, and its targets are likely to be different government entities, companies, and various industries. The TEMPFUN backdoor, in particular, has already been seen in action – it transmits data to the Command and Control server actively. The data in question is not special – TEMPFUN collects information about the infected computer's hardware, software and network configuration. The collected information is encrypted and transmitted to the control server - once this is done, TEMPFUN awaits a response that is likely to contain a command that it is meant to execute.

The operators of the TEMPFUN backdoor may be able to execute remote commands on the compromised host. While this may not seems too much, having the ability to execute remote commands enables them to control the processes and services of the computer, as well as to download and run additional payloads.

TEMPFUN has been found to share many similarities with HIPSTING, another backdoor Trojan that is likely to be used by APT groups. However, cybersecurity experts suggest that the two tools do not belong to the same group and, instead, their authors might have used the same development resources and libraries.

TEMPFUN does not utilize sandbox-evasion or anti-analysis techniques, which has allowed malware experts to intercept and analyze this backdoor activity swiftly.