1EjX8zl

2
Contents
Appendix A - related md5s .....................................................................................3
Downloaders, injectors, infostealers ...............................................................3
Appendix B. Fully Qualified Domain Names, Command and Control ................ 12
Appendix C. Code-signing certificates ................................................................ 17
Appendix D. Malcode Technical Notes ............................................................... 58
Small Downloader .......................................................................................... 58
Technical Details....................................................................................... 58
Information Stealer......................................................................................... 60
Technical Details....................................................................................... 60
Trojan.Win32.Karba.e..................................................................................... 64
Technical Notes......................................................................................... 64
Selective Infector............................................................................................ 67
Technical Notes......................................................................................... 67
Trojan-Dropper & Injector (infected legitimate files)..................................... 67
Technical Notes......................................................................................... 67
Enhanced Keyloggers and Development...................................................... 68
Technical Notes......................................................................................... 68
Keylogger Code............................................................................................... 68
Appendix E. Parallel and Previous Research...................................................... 73
TLP: Green
For any inquiries, please contact intelreports@kaspersky.com