MITRE ATT&CKsoftware (malware)
S0094 Trojan.Karagany
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- xFrost, Karagany
- Version
- 3.0
- Created
- 2017-05-31
Description
Trojan.Karagany is a modular remote access tool used for recon and linked to Dragonfly. The source code for Trojan.Karagany originated from Dream Loader malware which was leaked in 2010 and sold on underground forums.
Related
Uses · MITRE ATT&CK (22)
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1056.001 Keylogging sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.003 Thread Execution Hijacking sub-technique
- T1003 OS Credential Dumping technique
- T1010 Application Window Discovery technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1113 Screen Capture technique
Referenced by MITRE ATT&CK · uses (1)
- G0035 Dragonfly group
References
- https://www.dragos.com/threat/dymalloy/ Dragos DYMALLOY
- https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector Secureworks Karagany July 2019
- https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments Symantec Dragonfly