Trojan.Karagany is a backdoor primarily used for recon. The source code for it was leaked in 2010 and it is sold on underground forums. [1]

ID: S0094
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 17 March 2020

Techniques Used

Domain ID Name Use
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.[1]

Enterprise T1074 .001 Data Staged: Local Data Staging

Trojan.Karagany can create a directory (C:\ProgramData\Mail\MailAg\gl) to use as a temporary directory for uploading files.[1]

Enterprise T1105 Ingress Tool Transfer

Trojan.Karagany can upload, download, and execute files on the victim.[1]

Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.[1]

Enterprise T1003 OS Credential Dumping

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.[1]

Enterprise T1057 Process Discovery

Trojan.Karagany can use tasklist to collect a list of running tasks.[1]

Enterprise T1113 Screen Capture

Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.[1]

Groups That Use This Software

ID Name References
G0035 Dragonfly