Krachulka

The campaigns we see always come in waves and more than 90% of them are distributed through spam.

T1566.001 Phishing: Spearphishing Attachment ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1566.002 Phishing: Spearphishing Link ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ✅

T1059 Command and Scripting Interpreter ❌ ✅ ❌ ❌ ✅ ❌ ✅ ❌ ❌ ❌ ✅ ❌

T1059.003 Command and Scripting Interpreter: Windows Command Shell ❌ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ❌ ✅ ✅ ❌

they heavily rely on scripting languages, mainly VBScript

T1197 BITS Jobs ❌ ✅ ❌ ✅ ✅ ❌ ✅ ❌ ❌ ❌ ❌ ❌

The vast majority are distributed via spam, usually leading to a ZIP archive or an MSI installer.

T1197 BITS Jobs ❌ ✅ ❌ ✅ ✅ ❌ ✅ ❌ ❌ ❌ ❌ ❌

Registry Run key or Startup folder are the most common methods of persistence

Registry Run key or Startup folder are the most common methods of persistence

Its most noticeable characteristic was its usage of well-known cryptographic methods to encrypt strings... Zumanek is identified by its method for obfuscating strings.

they all obfuscate either payloads or configuration data in some way

T1197 BITS Jobs ❌ ✅ ❌ ✅ ✅ ❌ ✅ ❌ ❌ ❌ ❌ ❌

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

to steal credentials, they tend to use either fake pop-up windows or keyloggers

to steal credentials, they tend to use either fake pop-up windows or keyloggers

periodically scanning active windows based on name or title

T1057 Process Discovery ❌ ✅ ✅ ❌ ✅ ✅ ✅ ✅ ✅ ❌ ✅ ❌

T1082 System Information Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

T1083 File and Directory Discovery ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌

T1497.001 Virtualization/Sandbox Evasion: System Checks ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌

they devote considerable effort to collect screenshots and scan for security software

Operators need to react to this situation and manually command the malware to display the fake pop-up window and take control of the victim’s machine

to steal credentials, they tend to use either fake pop-up windows or keyloggers

to steal credentials, they tend to use either fake pop-up windows or keyloggers

they devote considerable effort to collect screenshots

Its downloaders simply downloaded a ZIP archive containing only the banking trojan executable

T1132.001 Data Encoding: Standard Encoding ❌ ✅ ✅ ✅ ✅ ❌ ❌ ❌ ❌ ❌ ✅ ✅

custom encryption algorithms are favored over established ones

suspiciously similar DGAs to obtain C&C server addresses

T1571 Non-Standard Port ✅ ✅ ✅ ❌ ✅ ❌ ✅ ✅ ✅ ❌ ✅ ✅

T1041 Exfiltration Over C2 Channel ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

they do not exfiltrate all harvested data to the C&C server, but use different locations as well