Secureworks Karagany July 2019

Trojan.Karagany can monitor the titles of open windows to identify specific keywords.

Trojan.Karagany can gather information on the network configuration of a compromised host.

Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

Trojan.Karagany can gather information about the user on a compromised host.

Trojan.Karagany can use netstat to collect a list of network connections.

Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.

Trojan.Karagany can capture keystrokes on a compromised host.

Trojan.Karagany can use Tasklist to collect a list of running tasks.

Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.

Trojan.Karagany has used plugins with a self-delete capability.

Trojan.Karagany can communicate with C2 via HTTP POST requests.

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.

Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.

Trojan.Karagany can enumerate files and directories on a compromised host.

Trojan.Karagany can upload, download, and execute files on the victim.

Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.

Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

Trojan.Karagany can steal data and credentials from browsers.

Trojan.Karagany can secure C2 communications with SSL and TLS.