Procedure examples

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Carberp has used user mode rootkit techniques to remain hidden on the system.

Carberp can start a remote VNC session by downloading a new plugin.

Carberp has used XOR-based encryption to mask C2 server locations within the trojan.

Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".

Carberp has exfiltrated data via HTTP to already established C2 servers.

Carberp's bootkit can inject a malicious DLL into the address space of running processes.

Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Carberp has hooked several Windows API functions to steal credentials.

Carberp has collected a list of running processes.

Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.

Carberp has connected to C2 servers via HTTP.

Carberp has collected the operating system version from the infected system.

Carberp can download and execute new plugins from the C2 server.

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.

Carberp can capture display screenshots with the screens_dll.dll plugin.

Carberp has captured credentials when a user performs login through a SSL session.

Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.

Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.

Carberp has installed a bootkit on the system to maintain persistence.

Carberp has maintained persistence by placing itself inside the current user's startup folder.

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Carberp has created a hidden file in the Startup folder of the current user.

Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.