Lookout Dark Caracal Jan 2018

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.

Dark Caracal has used UPX to pack Bandook.

Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.

Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.

Dark Caracal has used macros in Word documents that would download a second stage if executed.

Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.

Dark Caracal collected file listings of all default Windows directories.

CrossRAT can list all files on a system.

Dark Caracal took screenshots using their Windows malware.

Bandook is capable of taking an image of and uploading the current desktop.

CrossRAT is capable of taking screen captures.

Dark Caracal leveraged a watering hole to serve up malicious code.

Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.

Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.

CrossRAT creates a Launch Agent on macOS.

Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

CrossRAT uses run keys for persistence on Windows.

Dark Caracal spearphished victims via Facebook and Whatsapp.