Trojan.Karagany
Trojan.Karagany is a backdoor primarily used for recon. The source code for it was leaked in 2010 and it is sold on underground forums. [1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.[1] |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Trojan.Karagany can create a directory ( |
| Enterprise | T1105 | Ingress Tool Transfer |
Trojan.Karagany can upload, download, and execute files on the victim.[1] |
|
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.[1] |
| Enterprise | T1003 | OS Credential Dumping |
Trojan.Karagany can dump passwords and save them into |
|
| Enterprise | T1057 | Process Discovery |
Trojan.Karagany can use tasklist to collect a list of running tasks.[1] |
|
| Enterprise | T1113 | Screen Capture |
Trojan.Karagany can take a desktop screenshot and save the file into |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0035 | Dragonfly |