CarbanakMalware
- sekur rat
MyCERT states that Carbanak is a remote backdoor designed for espionage, data exfiltration, and to remote control. The attacker deploy malware via spear phishing email to lure the user to open and run the malicious attachment that will infect the machine.From MISP Galaxy
Last reported 6 years ago, by Group-IB3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1218.001Compiled HTML File
“Here another interesting technique – Compiled HTML File (T1223).”
- T1546.011Application Shimming
“Next tactics – Persistence (TA0001) and Privilege Escalation (TA0004), and Application Shimming (T1138) as an example.”
- T1566.001Spearphishing Attachment
“Let’s start from the Initial Access tactic (TA0001) and the most common technique – Spearphishing Attachment (T1193).”
What the reports say
3 reports, newest first · the exact sentence from each-
Hunting for Attacker’s Tactics and Techniques With Prefetch Files“This technique was used by notorious Carbanak/FIN7 for persistence.”
-
Silence: Moving into the Darkside“…nths between incidents, which is approximately three times longer than other financially motivated APT groups, like MoneyTaker, Anunak (Carbanak), Buhtrap or Cobalt.”
-
Cobalt Renaissance“Considering that the latest attacks by the Anunak/Carbanak group were also targeting a number of hotels in order to obtain card data, the probability of a connection between these two hacker groups is high.”
Indicators in its reports
named in the reports above- ccleaner64.exe-de05dbe1[.]pfin 1 report
- kaspersky-corporate[.]comin 1 report
- 172.217.22[.]110in 1 report
- 194.58.112[.]174in 1 report
- 62.76.40[.]207in 1 report
- mail.kaspersky-corporate[.]comin 1 report
- hxxps://kaspersky-security[.]com/Complaint.docin 1 report
- kaspersky-security[.]comin 1 report
- fa354151a3fc6d0dce69e8eeaa8cd197in 1 report
- 91.230.121[.]86in 1 report
- 7b55c7ae346efb428aaf63d25ca0fcc7in 1 report
- foxsecit[.]comin 1 report
- 185.86.79[.]156in 1 report
- ibm-notice[.]comin 1 report
- spamhuas[.]comin 1 report
- hoteltoren[.]comin 1 report
- dns-verifon[.]comin 1 report
- spam-huas[.]comin 1 report
- 37.1.212[.]129in 1 report
- 37.1.211[.]165in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.