MALWARE FAMILY

More_eggs

Internal ID: js.more_eggs

aliases

Last seen:Mar 17, 2026

Intelligence Profile

More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are:

- d&exec = download and execute PE file

- gtfo = delete files/startup entries and terminate

- more_eggs = download additional/new scripts

- more_onion = run new script and terminate current script

- more_power = run command shell commands

Threat Analysis

More_eggs is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.secureworks.com/research/threat-profiles/gold-kingswood

→https://arcticwolf.com/resources/blog/venom-spider-uses-server-side-polymorphism-to-weave-a-web-around-victims/

→https://asert.arbornetworks.com/double-the-infection-double-the-fun/

→https://attack.mitre.org/software/S0284/

→https://blog.morphisec.com/cobalt-gang-2.0

→https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/

→https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/

→https://denwp.com/more-eggs-venom-spider-phishing-campaign/

→https://expel.com/blog/more-eggs-and-some-linkedin-resume-spearphishing

Quick Facts

TypeMalware Family

Aliases1

Also Known As

js.more_eggs

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search More_eggs