Trojan.Karagany
Trojan.Karagany is a modular remote access tool used for recon and linked to Dragonfly and Dragonfly 2.0. The source code for Trojan.Karagany originated from Dream Loader malware which was leaked in 2010 and sold on underground forums. [1][2][3]
Associated Software Descriptions
| Name | Description |
|---|---|
| xFrost | |
| Karagany |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Trojan.Karagany can communicate with C2 via HTTP POST requests.[2] |
| Enterprise | T1010 | Application Window Discovery |
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.[2] |
|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.[1][2] |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.[2] |
| Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
Trojan.Karagany can steal data and credentials from browsers.[2] |
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.[1][2] |
| Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
Trojan.Karagany can secure C2 communications with SSL and TLS.[2] |
| Enterprise | T1083 | File and Directory Discovery |
Trojan.Karagany can enumerate files and directories on a compromised host.[2] |
|
| Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Trojan.Karagany has used plugins with a self-delete capability.[2] |
| Enterprise | T1105 | Ingress Tool Transfer |
Trojan.Karagany can upload, download, and execute files on the victim.[1][2] |
|
| Enterprise | T1056 | .001 | Input Capture: Keylogging |
Trojan.Karagany can capture keystrokes on a compromised host.[2] |
| Enterprise | T1027 | Obfuscated Files or Information |
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.[2] |
|
| .002 | Software Packing |
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.[1][2] |
||
| Enterprise | T1003 | OS Credential Dumping |
Trojan.Karagany can dump passwords and save them into |
|
| Enterprise | T1057 | Process Discovery |
Trojan.Karagany can use Tasklist to collect a list of running tasks.[1][2] |
|
| Enterprise | T1055 | .003 | Process Injection: Thread Execution Hijacking |
Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the |
| Enterprise | T1113 | Screen Capture |
Trojan.Karagany can take a desktop screenshot and save the file into |
|
| Enterprise | T1082 | System Information Discovery |
Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.[2] |
|
| Enterprise | T1016 | System Network Configuration Discovery |
Trojan.Karagany can gather information on the network configuration of a compromised host.[2] |
|
| Enterprise | T1049 | System Network Connections Discovery |
Trojan.Karagany can use netstat to collect a list of network connections.[2] |
|
| Enterprise | T1033 | System Owner/User Discovery |
Trojan.Karagany can gather information about the user on a compromised host.[2] |
|
| Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.[2] |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0035 | Dragonfly | |
| G0074 | Dragonfly 2.0 |