Loading malware…
Carberp is a Windows banking trojan first observed in 2009 and developed to steal online banking credentials and facilitate financial fraud. It became notable for combining credential theft with stealth, persistence, browser-focused data collection, and modular post-compromise functionality. Carberp has been associated with criminal banking operations and later influenced or contributed code and techniques to successor malware families after its source code and bootkit components leaked in 2013. Reporting has also linked its tooling to later financially motivated actors, including use by the Carbanak gang.
Carberp targets Microsoft Windows systems and is known for capabilities including keylogging, browser credential theft, screenshot capture, process discovery, and exfiltration of stolen data over HTTP to command-and-control infrastructure. Its password-stealing plugin can collect credentials stored in major browsers including Opera, Internet Explorer, Safari, Firefox, and Chrome. Additional modules can capture screenshots, and the malware can enumerate running processes as part of host reconnaissance and operational decision-making.
The malware employs multiple defense-evasion and persistence mechanisms. It has been observed persisting through the current user’s Startup folder, including creation of hidden startup artifacts. It can masquerade as legitimate Windows system files and use native API functions to hide files and directories. Carberp also queries the system for indicators of installed antivirus products, reflecting security software discovery behavior intended to tailor execution or avoid detection.
Carberp is also notable for more advanced execution tradecraft. Its bootkit component can inject malicious DLLs into running processes, and the family has been associated with HiddenVNC-style remote interaction on hidden desktops in banking malware operations. Separate reporting has described Carberp functionality for modifying the Java Virtual Machine and tracking payment software activity, indicating a focus beyond ordinary web banking toward specialized financial software environments.
The family is widely regarded as an important banking malware lineage whose leaked code informed later threats and successors such as Bolik, and whose techniques influenced other banking trojans that adopted hidden desktop abuse, browser theft, and stealth-oriented persistence.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Carberp. This malware first emerged in 2009. Its purpose was to steal banking credentials.
Our presentation starts with a consideration of the evolution of the Carberp family of banking malware... Hodprot, the latest Carberp cybercrime group, switched to using RDPdoor v4.2.x
Both the "btecache.dll" and "svchost.dll" files contain code from the leaked Carberp source code, specifically the API resolution functions, as well as the RC2 key.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Rovnix was the first bootkit family to use VBR (Volume Boot Record) infection (NTFS bootstrap code) for loading unsigned kernel-mode drivers on x64 (64 bit) platforms.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
File vnc.plug is an executable that enables remote access to an infected computer via remote framebuffer protocol (RFB). Additionally, it contains an embedded library inj_x86.dll ( inj_x64.dll respectively) which provides a user mode rootkit functionality that masks processes started remotely
we discovered that the author of of TeslaCrypt borrowed code from the Carberp malware family in order to obfuscate strings
the author has also implemented dynamic library and function loading.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Carberp works like many other banking trojans by logging keystrokes, spoofing websites, and hiding instances of itself in specific locations.
It is a set of JavaScript web injects performing an attack to various internet banking systems in Russia and Ukraine. Injects are triggered by particular masks in a web browser
Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
Carberp works like many other banking trojans by logging keystrokes, spoofing websites, and hiding instances of itself in specific locations.
The first one used the RC4 cipher to encrypt data exchanged with C&C and it posted requests in the form: http://<top level domain>/e/<8-11 random alphanumeric characters> ... The second one was based on RC2 cipher ... A typical HTTP post looked like POST /kmqkcicalxrntrngwdxjyxztxcqkoyjnbdoafqirgnwwvpcjqglucovna.phtm HTTP/1.1 | These apps posted HTTP requests in the form: http://ber<REMOVED>.com/m/fo125kepro;http://ber<REMOVED>.com/m/as225kerto ; with the domain that was also used as C&C by the branch of Carberp using RC4 encryption.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
93 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Banking trojan referenced historically as part of prior Russian cybercrime enforcement actions.
A banking trojan whose leaked code was used in part to build Carbanak.
Referenced as a heavyweight commodity malware family from the period of frequent public reverse-engineering reports.
Referenced only as leaked source code reused by multiple malware families including those discussed here.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.