Procedure examples

Kazuar uploads files from a specified directory to the C2 server.

Kazuar can accept multiple URLs for C2 servers.

Kazuar gathers information about opened windows.

Kazuar gathers information about network adapters.

Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.

Kazuar can sleep for a specific time and be set to communicate at specific intervals.

Kazuar gathers information on users.

Kazuar obtains a list of running processes through WMI querying.

If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.

Kazuar obtains a list of running processes through WMI querying and the ps command.

Kazuar uses cmd.exe to execute commands on the victim’s machine.

Kazuar uses /bin/bash to execute commands on the victim’s machine.

Kazuar gathers information about local groups and members.

Kazuar can delete files.

Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.

Kazuar uses FTP and FTPS to communicate with the C2 server.

Kazuar stages command output and collected data in files before exfiltration.

Kazuar gathers information on the system.

Kazuar finds a specified directory, lists the files and metadata about those files.

Kazuar gathers information on local groups and members on the victim’s machine.

Kazuar has used internal nodes on the compromised network for C2 communications.

Kazuar has used compromised WordPress blogs as C2 servers.

Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.

Kazuar captures screenshots of the victim’s screen.

Kazuar captures images from the webcam.

Kazuar encodes communications to the C2 server in Base64.

Kazuar can overwrite files with random data before deleting them.

Kazuar can install itself as a new service.

Kazuar adds a sub-key under several Registry run keys.

Kazuar adds a .lnk file to the Windows startup folder.

Kazuar gathers information on local drives.