Kaspersky Ferocious Kitten Jun 2021

MarkiRAT can upload data from the victim's machine to the C2 server.

MarkiRAT can retrieve the victim’s username.

Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.

MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.

Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.

MarkiRAT can exfiltrate locally stored data via its C2.

MarkiRAT can capture all keystrokes on a compromised host.

MarkiRAT can search for different processes on a system.

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.

MarkiRAT can store collected data locally in a created .nfo file.

MarkiRAT can obtain the computer name from a compromised host.

MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.

MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.

MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.

MarkiRAT can capture clipboard content.

MarkiRAT can use BITS Utility to connect with the C2 server.

Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.

MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.

MarkiRAT can gather information from the Keepass password manager.

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.

Ferocious Kitten has acquired domains imitating legitimate sites.

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.

MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.