Prikormka

Prikormka is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. [1]

ID: S0113
Type: MALWARE
Platforms: Windows
Version: 1.1

Techniques Used

Domain ID Name Use
Enterprise T1003 Credential Dumping

A module in Prikormka collects passwords stored in applications installed on the victim.[1]

Enterprise T1503 Credentials from Web Browsers

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.[1]

Enterprise T1002 Data Compressed

After collecting documents from removable media, Prikormka compresses the collected files.[1]

Enterprise T1132 Data Encoding

Prikormka encodes C2 traffic with Base64.[1]

Enterprise T1022 Data Encrypted

After collecting files and logs from the victim, Prikormka encrypts some collected data with Blowfish.[1]

Enterprise T1025 Data from Removable Media

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.[1]

Enterprise T1074 Data Staged

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.[1]

Enterprise T1038 DLL Search Order Hijacking

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.[1]

Enterprise T1083 File and Directory Discovery

A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.[1]

Enterprise T1070 Indicator Removal on Host

After encrypting log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[1]

Enterprise T1056 Input Capture

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.[1]

Enterprise T1027 Obfuscated Files or Information

Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.[1]

Enterprise T1120 Peripheral Device Discovery

A module in Prikormka collects information on available printers and disk drives.[1]

Enterprise T1060 Registry Run Keys / Startup Folder

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.[1]

Enterprise T1085 Rundll32

Prikormka uses rundll32.exe to load its DLL.[1]

Enterprise T1113 Screen Capture

Prikormka contains a module that captures screenshots of the victim's desktop.[1]

Enterprise T1063 Security Software Discovery

A module in Prikormka collects information from the victim about installed anti-virus software.[1]

Enterprise T1032 Standard Cryptographic Protocol

Prikormka encrypts some C2 traffic with the Blowfish cipher.[1]

Enterprise T1082 System Information Discovery

A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.[1]

Enterprise T1016 System Network Configuration Discovery

A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.[1]

Enterprise T1033 System Owner/User Discovery

A module in Prikormka collects information from the victim about the current user name.[1]

References