Symantec Dragonfly

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.

Backdoor.Oldrea collects information about the Internet adapter configuration.

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

Backdoor.Oldrea collects the current username from the victim.

Backdoor.Oldrea injects itself into explorer.exe.

Backdoor.Oldrea collects information about running processes.

Trojan.Karagany can use Tasklist to collect a list of running tasks.

Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.

Backdoor.Oldrea collects information about the OS and computer name.

Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.

Backdoor.Oldrea collects address book information from Outlook.

Trojan.Karagany can upload, download, and execute files on the victim.

Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.

Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Backdoor.Oldrea adds Registry Run keys to achieve persistence.

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.