SYMBOLCOMMON_NAMEaka. SYNONYMS
win.karius (Back to overview)

Karius


According to checkpoint, Karius is a banking trojan in development, borrowing code from Ramnit, Vawtrack as well as Trickbot, currently implementing webinject attacks only.

It comes with an injector that loads an intermediate "proxy" component, which in turn loads the actual banker component.

Communication with the c2 are in json format and encrypted with RC4 with a hardcoded key.

In the initial version, observed in March 2018, the webinjects were hardcoded in the binary, while in subsequent versions, they were received by the c2.

References
2022-08-18IBMCharlotte Hammond, Ole Villadsen
@online{hammond:20220818:from:501e8ac, author = {Charlotte Hammond and Ole Villadsen}, title = {{From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers}}, date = {2022-08-18}, organization = {IBM}, url = {https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest}, language = {English}, urldate = {2022-08-28} } From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers
BumbleBee Karius Ramnit TrickBot Vawtrak
2018-06-06Check PointCheck Point Research
@online{research:20180606:banking:97835c7, author = {Check Point Research}, title = {{Banking Trojans Under Development}}, date = {2018-06-06}, organization = {Check Point}, url = {https://research.checkpoint.com/banking-trojans-development/}, language = {English}, urldate = {2019-11-21} } Banking Trojans Under Development
Karius
2018-03-28Malwrologist
@online{malwrologist:20180328:multistage:0fade2d, author = {Malwrologist}, title = {{Multi-stage Powershell script (Brownies)}}, date = {2018-03-28}, url = {https://dissectmalware.wordpress.com/2018/03/28/multi-stage-powershell-script/}, language = {English}, urldate = {2020-01-08} } Multi-stage Powershell script (Brownies)
Karius
Yara Rules
[TLP:WHITE] win_karius_auto (20230125 | Detects win.karius.)
rule win_karius_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.karius."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 41b830000000 488bcf ff15???????? 4885c0 }
            // n = 4, score = 400
            //   41b830000000         | jne                 0x14
            //   488bcf               | inc                 ecx
            //   ff15????????         |                     
            //   4885c0               | mov                 eax, 0x30

        $sequence_1 = { c3 85c0 7505 e8???????? b801000000 }
            // n = 5, score = 400
            //   c3                   | inc                 ecx
            //   85c0                 | mov                 eax, 0x100000
            //   7505                 | dec                 eax
            //   e8????????           |                     
            //   b801000000           | mov                 ecx, esi

        $sequence_2 = { 488b05???????? 4885c0 7512 ff15???????? 488905???????? }
            // n = 5, score = 400
            //   488b05????????       |                     
            //   4885c0               | dec                 eax
            //   7512                 | test                eax, eax
            //   ff15????????         |                     
            //   488905????????       |                     

        $sequence_3 = { 8b4508 321c06 0fb60406 80e31f 33f8 }
            // n = 5, score = 300
            //   8b4508               | dec                 eax
            //   321c06               | mov                 ecx, esi
            //   0fb60406             | dec                 esp
            //   80e31f               | mov                 esi, eax
            //   33f8                 | dec                 eax

        $sequence_4 = { 8bc7 ffc8 7416 ffc8 }
            // n = 4, score = 300
            //   8bc7                 | mov                 ecx, esi
            //   ffc8                 | dec                 ebp
            //   7416                 | mov                 ecx, esp
            //   ffc8                 | dec                 ebp

        $sequence_5 = { 7416 400fb6c7 4002f1 412ac4 }
            // n = 4, score = 300
            //   7416                 | dec                 eax
            //   400fb6c7             | mov                 ecx, esi
            //   4002f1               | dec                 eax
            //   412ac4               | lea                 ecx, [ebx + 0x10]

        $sequence_6 = { 33c9 85c0 0f95c1 8d4102 4883c420 }
            // n = 5, score = 300
            //   33c9                 | xor                 edx, edx
            //   85c0                 | inc                 ecx
            //   0f95c1               | mov                 eax, 0x100000
            //   8d4102               | dec                 eax
            //   4883c420             | mov                 ecx, esi

        $sequence_7 = { 85c0 7517 8b4508 5e }
            // n = 4, score = 300
            //   85c0                 | dec                 eax
            //   7517                 | je                  0x1a
            //   8b4508               | dec                 eax
            //   5e                   | ret                 

        $sequence_8 = { 48895c2420 4d8bcc 4d8bc7 488bd0 488bce ff15???????? }
            // n = 6, score = 300
            //   48895c2420           | test                eax, eax
            //   4d8bcc               | jne                 0x14
            //   4d8bc7               | dec                 eax
            //   488bd0               | test                eax, eax
            //   488bce               | dec                 eax
            //   ff15????????         |                     

        $sequence_9 = { 488bd8 4885c0 7509 8d4303 }
            // n = 4, score = 300
            //   488bd8               | mov                 ecx, esi
            //   4885c0               | dec                 esp
            //   7509                 | mov                 esi, eax
            //   8d4303               | mov                 eax, edi

        $sequence_10 = { 33d2 488bce ff15???????? 4c8bf0 4885c0 }
            // n = 5, score = 300
            //   33d2                 | test                eax, eax
            //   488bce               | dec                 eax
            //   ff15????????         |                     
            //   4c8bf0               | mov                 dword ptr [esp + 0x20], ebx
            //   4885c0               | dec                 ebp

        $sequence_11 = { 03c1 5d c3 3c41 }
            // n = 4, score = 300
            //   03c1                 | dec                 ecx
            //   5d                   | mov                 ecx, esi
            //   c3                   | dec                 ebp
            //   3c41                 | test                ebp, ebp

        $sequence_12 = { 85c0 7506 40883e 83cbff 873d???????? 488b742430 }
            // n = 6, score = 300
            //   85c0                 | mov                 edx, eax
            //   7506                 | dec                 eax
            //   40883e               | mov                 ecx, esi
            //   83cbff               | lea                 edi, [ebx + 1]
            //   873d????????         |                     
            //   488b742430           | inc                 esp

        $sequence_13 = { 7309 ffc0 413b00 72e9 }
            // n = 4, score = 300
            //   7309                 | dec                 eax
            //   ffc0                 | lea                 edx, [esp + 0x50]
            //   413b00               | inc                 ecx
            //   72e9                 | mov                 eax, 4

        $sequence_14 = { 488d4b10 488d542450 41b804000000 c6430f68 }
            // n = 4, score = 300
            //   488d4b10             | dec                 esp
            //   488d542450           | mov                 ebp, eax
            //   41b804000000         | dec                 ecx
            //   c6430f68             | mov                 ecx, esi

        $sequence_15 = { 0f849d000000 41837b1400 0f8492000000 458b4320 458b5324 }
            // n = 5, score = 300
            //   0f849d000000         | cmp                 ax, 9
            //   41837b1400           | jne                 7
            //   0f8492000000         | lea                 edi, [ebx + 2]
            //   458b4320             | jmp                 0x10
            //   458b5324             | test                ax, ax

        $sequence_16 = { 3bc3 8a6514 0f93c0 eb07 803c1700 }
            // n = 5, score = 300
            //   3bc3                 | inc                 esp
            //   8a6514               | mov                 eax, eax
            //   0f93c0               | xor                 edx, edx
            //   eb07                 | dec                 eax
            //   803c1700             | mov                 ecx, esi

        $sequence_17 = { 0f84b3000000 458b9f88000000 4d03de 418b5b18 }
            // n = 4, score = 300
            //   0f84b3000000         | mov                 ecx, eax
            //   458b9f88000000       | dec                 esp
            //   4d03de               | mov                 ebp, eax
            //   418b5b18             | dec                 ecx

        $sequence_18 = { 8bd7 498bce ffd3 4183bf8c00000000 0f84b3000000 }
            // n = 5, score = 300
            //   8bd7                 | test                eax, eax
            //   498bce               | dec                 esp
            //   ffd3                 | mov                 ebp, eax
            //   4183bf8c00000000     | dec                 ecx
            //   0f84b3000000         | mov                 ecx, esi

        $sequence_19 = { c6430502 418bc1 4584c0 0f8851010000 41f6c010 7432 }
            // n = 6, score = 300
            //   c6430502             | mov                 byte ptr [ebx + 0xf], 0x68
            //   418bc1               | mov                 eax, edi
            //   4584c0               | dec                 eax
            //   0f8851010000         | je                  0x1a
            //   41f6c010             | dec                 eax
            //   7432                 | jne                 0x2a

        $sequence_20 = { 488bc8 ff15???????? 4c8be8 498bce ff15???????? 4d85ed }
            // n = 6, score = 300
            //   488bc8               | mov                 edx, eax
            //   ff15????????         |                     
            //   4c8be8               | dec                 eax
            //   498bce               | mov                 ecx, esi
            //   ff15????????         |                     
            //   4d85ed               | test                eax, eax

        $sequence_21 = { 46 47 ebc8 8a06 3c41 }
            // n = 5, score = 300
            //   46                   | xor                 edx, edx
            //   47                   | dec                 eax
            //   ebc8                 | mov                 ecx, esi
            //   8a06                 | dec                 esp
            //   3c41                 | mov                 esi, eax

        $sequence_22 = { 8b4d0c 85c0 740a 8b1b 85db 0f8573ffffff }
            // n = 6, score = 300
            //   8b4d0c               | dec                 eax
            //   85c0                 | test                eax, eax
            //   740a                 | jne                 7
            //   8b1b                 | lea                 edi, [ebx + 2]
            //   85db                 | jmp                 0xe
            //   0f8573ffffff         | test                ax, ax

        $sequence_23 = { 8b4508 85c0 7417 8b4008 85c0 }
            // n = 5, score = 300
            //   8b4508               | dec                 esp
            //   85c0                 | mov                 esi, eax
            //   7417                 | dec                 eax
            //   8b4008               | test                eax, eax
            //   85c0                 | mov                 eax, edi

        $sequence_24 = { 80e31f 33f8 0fb6cb 46 }
            // n = 4, score = 300
            //   80e31f               | dec                 eax
            //   33f8                 | mov                 ecx, eax
            //   0fb6cb               | dec                 esp
            //   46                   | mov                 ebp, eax

        $sequence_25 = { ff15???????? 488bf8 4885c0 7505 8d4701 }
            // n = 5, score = 300
            //   ff15????????         |                     
            //   488bf8               | dec                 eax
            //   4885c0               | mov                 ecx, esi
            //   7505                 | dec                 ebp
            //   8d4701               | mov                 eax, edi

        $sequence_26 = { 4d8bcf 33d2 41b800001000 488bce ff15???????? }
            // n = 5, score = 300
            //   4d8bcf               | dec                 eax
            //   33d2                 | mov                 edx, eax
            //   41b800001000         | dec                 eax
            //   488bce               | mov                 ecx, esi
            //   ff15????????         |                     

        $sequence_27 = { 7505 8d7b02 eb09 6685c0 }
            // n = 4, score = 300
            //   7505                 | mov                 ecx, esp
            //   8d7b02               | dec                 ebp
            //   eb09                 | mov                 eax, edi
            //   6685c0               | dec                 eax

        $sequence_28 = { b805000000 c3 418d4018 3c01 7624 4180f8ff }
            // n = 6, score = 300
            //   b805000000           | dec                 eax
            //   c3                   | test                eax, eax
            //   418d4018             | dec                 ebp
            //   3c01                 | mov                 eax, edi
            //   7624                 | dec                 eax
            //   4180f8ff             | mov                 edx, eax

    condition:
        7 of them and filesize < 434176
}
Download all Yara Rules