ESET Okrum July 2019

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

Okrum was seen using MimikatzLite to perform credential dumping.

Okrum was seen using modified Quarks PwDump to perform credential dumping.

Okrum can collect network information, including the host IP address, DNS, and proxy information.

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.

Okrum can collect the victim username.

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.

Data exfiltration is done by Okrum using the already opened channel with the C2 server.

Okrum was seen using NetSess to discover NetBIOS sessions.

Okrum's installer can attempt to achieve persistence by creating a scheduled task.

Okrum was seen using a keylogger tool to capture keystrokes.

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.

Okrum uses HTTP for communication with its C2.

Okrum can collect computer name, locale information, and information about the OS and architecture.

Okrum has used DriveLetterView to enumerate drive information.

Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.

Okrum has built-in commands for uploading, downloading, and executing files to the system.

Okrum can obtain the date and time of the compromised system.

Okrum has used base64 to encode C2 communication.

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.

Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.

Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.

Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.

To establish persistence, Okrum can install itself as a new service named NtmSsvc.

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.

Okrum was seen using a RAR archiver tool to compress/decompress data.

Okrum has used a custom implementation of AES encryption to encrypt collected data.

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.

Okrum's loader can create a new service named NtmsSvc to execute the payload.

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.