FireEye CARBANAK June 2017

Carbanak obtains Windows logon password details.

Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.

Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.

Carbanak encrypts strings to make analysis more difficult.

Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .

Carbanak downloads an executable and injects it directly into a new process.

Carbanak logs key strokes for configured processes and sends them back to the C2 server.

Carbanak lists running processes.

Carbanak has a command to create a reverse shell.

Carbanak has a command to delete files.

Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.

Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.

Carbanak encodes the message body of HTTP traffic with Base64.

Carbanak can create a Windows account.

Carbanak has a plugin for VNC and Ammyy Admin Tool.

Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.