Threat Group Cards: A Threat Actor Encyclopedia
Excerpt
Home > List all groups > List all tools > List all groups using tool Karkoff Tool: Karkoff
Names
Karkoff
MailDropper
DropperBackdoor
CACTUSPIPE
OILYFACE
Category Malware
Type Backdoor, Dropper
Description
(Talos) In April, Cisco Talos identified an undocumented malware developed in .NET. On the analyzed samples, the malware author left two different internal names in plain text:
'DropperBackdoor' and 'Karkoff.' We decided to use the second name as the malware's moniker, as it is less generic. The malware is lightweight compared to other malware due to its small size and allows remote code execution from the C2 server. There is no obfuscation and the code can be easily disassembled.
Informa…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ETDA Threat Group Cards on apt.etda.or.th.
Mentioned in the excerpt
More from ETDA Threat Group Cards19
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 20 Oct
- listgroups.cgi?u=72670111-f95a-423c-a296-f424939cc08eETDA Threat Group Cards · Added 19 Oct
- listgroups.cgi?u=cacc4de8-a9b2-4231-9fdb-8aefa8ed0a5cETDA Threat Group Cards · Added 19 Oct
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
