Carbanak

Malware & Tools · Carbanak

· MalwareS0030 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

Carbanak is a full-featured, remote backdoor used by a group of the same name (Carbanak). It is intended for espionage, data exfiltration, and providing remote access to infected machines. (Citation: Kaspersky Carbanak) (Citation: FireEye CARBANAK June 2017)

Tactic Coverage

command and control (4)stealth (3)collection (3)credential access (2)discovery (2)privilege escalation (2)persistence (2)lateral movement (1)exfiltration (1)execution (1)

Used By (2 groups)

G0008CarbanakAnunak G0046FIN7GOLD NIAGARA, ITG14

Techniques (18)

T1003OS Credential Dumping

credential access

T1012Query Registry

discovery

T1021.001Remote Desktop Protocol

lateral movement

T1027Obfuscated Files or Information

stealth

T1030Data Transfer Size Limits

exfiltration

T1055.002Portable Executable Injection

stealthprivilege escalation

References

https://attack.mitre.org/software/S0030 https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/