Procedure examples

KONNI has stored collected information and discovered processes in a tmp file.

KONNI can collect the IP address from the victim’s machine.

KONNI has been packed for obfuscation.

KONNI is heavily obfuscated and includes encrypted configuration files.

KONNI can collect the username from the victim’s machine.

KONNI has pretended to be the xmlProv Network Provisioning service.

KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.

KONNI has sent data and files to its C2 server.

KONNI has used FTP to exfiltrate reconnaissance data out.

KONNI has used net session on the victim's machine.

KONNI has the capability to perform keylogging.

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.

KONNI used PowerShell to download and execute a specific 64-bit version of the malware.

KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.

KONNI has executed malicious JavaScript code.

KONNI can delete files.

KONNI has used HTTP POST for C2.

KONNI can gather the OS version, architecture information, hostname, and RAM size information from the victim’s machine and has used cmd /c systeminfo command to get a snapshot of the current system state of the target machine.

A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.

KONNI can download files and execute them on the victim’s machine.

KONNI has hardcoded API calls within its functions to use on the victim's machine.

KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.

KONNI can take screenshots of the victim’s machine.

KONNI had a feature to steal data from the clipboard.

KONNI has used a custom base64 key to encode stolen data before exfiltration.

KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.

KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.

KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.

KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

KONNI has registered itself as a service using its export function.

KONNI has modified ComSysApp service to load the malicious DLL payload.

A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.

KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify".

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

KONNI has encrypted data and files prior to exfiltration.

KONNI has been delivered via spearphishing campaigns through a malicious Word document.

KONNI has used AES to encrypt C2 traffic.

KONNI can gather information on connected drives and disk space from the victim’s machine.