A malware package known as “Karagany” (also known as xFrost). Karagany is a modular remote access Trojan (RAT) linked to a threat-group known as IRON LIBERTY (aka, DragonFly2.0 and Energetic Bear). Karagany is believed to have been developed from the source code of a malware package called “Dream Loader” after it was leaked in 2010. It is believed that IRON LIBERTY has invested significant time and effort into modifying the source to create a malware package suited to their own operations. IRON LIBERTY has been targeting the energy industry in the United States and Europe since at least 2010. After public exposure in 2014, Secureworks believes the group retired its own tools and infrastructure. Then, in 2016, they re-emerged once again with a fresh campaign. Samples of Karagany from 2016 to 2018 indicate constant development on the code. The core of Karagany provides persistence to the victim’s device, file upload and download, plugin execution, and limited browser credential harvesting. Infection of victims is through manual installs. The group targets specific individuals in specific roles to acquire their Active Directory credentials. Using PsExec, the group then initiates a remote command session to the targeted system and installs the malware. Persistence to survive a system reboot is achieved by creating a LNK file in the Startup folder that points back to the malware. Communication with its command and control servers is via HTTP and the data is secured using SSL/TLS.
Malware Hash (MD5/SHA1/SH256)