Prevx Carberp March 2011

Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Carberp has used user mode rootkit techniques to remain hidden on the system.

Carberp can start a remote VNC session by downloading a new plugin.

Carberp has used XOR-based encryption to mask C2 server locations within the trojan.

Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".

Carberp has exfiltrated data via HTTP to already established C2 servers.

Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Carberp has hooked several Windows API functions to steal credentials.

Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.

Carberp has collected the operating system version from the infected system.

Carberp can download and execute new plugins from the C2 server.

Carberp can capture display screenshots with the screens_dll.dll plugin.

Carberp has captured credentials when a user performs login through a SSL session.

Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.

Carberp has maintained persistence by placing itself inside the current user's startup folder.

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.