ESET Operation Groundbait

A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.

Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.

A module in Prikormka collects information from the victim about the current user name.

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.

After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.

A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.

A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.

Prikormka contains a module that captures screenshots of the victim's desktop.

A module in Prikormka collects information on available printers and disk drives.

Prikormka encodes C2 traffic with Base64.

Prikormka uses rundll32.exe to load its DLL.

A module in Prikormka collects information from the victim about installed anti-virus software.

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.

A module in Prikormka collects passwords stored in applications installed on the victim.

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.

Prikormka encrypts some C2 traffic with the Blowfish cipher.

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.