Malware

Win32/Napolar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

it seems likely that this threat has been spread through Facebook. Since malware has the ability to steal Facebook credentials, its operator can reuse those credentials to send messages from compromised accounts and try to infect the victim’s friends.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The bot supports a variety of commands, from information stealing and SOCKS proxying, to denial of service, download, execution and update.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

It will then allocate another area of memory in the debugged process in which to inject the code.

Stealth

6 techniques

T1027.002Software PackingEvidence1

Most recent variants also use third party packers to evade antivirus detection and slow down manual reverse engineering.

T1027.007Dynamic API ResolutionEvidence1

All imports are resolved at runtime using hashes instead of the import names.

T1036MasqueradingEvidence1

the use of doubled file extensions (*.JPG.EXE, *.TXT.EXE and so forth) to obfuscate a file's true extension is an old trick

T1055Process InjectionEvidence1

It will then allocate another area of memory in the debugged process in which to inject the code.

T1140Deobfuscate/Decode Files or InformationEvidence1

The second function decrypts more code using the RC4 encryption algorithm and the key 0xDEADBEEF. The third TLS function decrypts the rest of the code before calling the main body of the malware.

T1622Debugger EvasionEvidence1

This is a clever way of altering the behavior of the malware if it is being analyzed with a debugger and if a software breakpoint is put on the first instruction of the TLS.

Credential Access

1 technique

T1056.003Web Portal CaptureEvidence1

The malware is able to hook into various browsers to steal information that is submitted in web forms.

Discovery

1 technique

T1622Debugger EvasionEvidence1

This is a clever way of altering the behavior of the malware if it is being analyzed with a debugger and if a software breakpoint is put on the first instruction of the TLS.

Collection

1 technique

T1056.003Web Portal CaptureEvidence1

The malware is able to hook into various browsers to steal information that is submitted in web forms.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

When communicating with its command and control server, Win32/Napolar uses the HTTP protocol.

T1090.003Multi-hop ProxyEvidence1

The three main ones are to conduct Denial of Service attacks, to act as a SOCKS proxy server, and to steal information from infected systems.

T1105Ingress Tool TransferEvidence1

The bot supports a variety of commands, from information stealing and SOCKS proxying, to denial of service, download, execution and update.

T1573Encrypted ChannelEvidence1

These commands are encrypted using RC4, The bot unique identifier is used as the encryption key.

Impact

1 technique

T1498Network Denial of ServiceEvidence1

The three main ones are to conduct Denial of Service attacks, to act as a SOCKS proxy server, and to steal information from infected systems.

Other

1 technique

T1562Impair DefensesEvidence1

It will iterate through all the running processes and specifically kill any process that has the string “ trusteer ” in it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app13 years ago

hash.sha1●●●●●●●●●●●●View more in app13 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

eset welivesecurity blogNews

Dec 18, 2013

Qadars - a banking Trojan with the Netherlands in its sights

Mentioned in conclusion as another recently emerged banking trojan.

eset welivesecurity blogNews

Sep 25, 2013

Win32/Napolar - A new bot on the block

A multifunction bot malware family used for denial-of-service attacks, SOCKS proxying, and information theft. It hooks browsers to steal web form data, uses anti-debugging and self-debugging techniques, injects into processes, communicates with C2 over HTTP using RC4-encrypted commands, and supports download, execution, update, and sleep commands. The promotional site also advertised plugins including Bitcoin wallet theft.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Win32/Napolar

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The bot supports a variety of commands, from information stealing and SOCKS proxying, to denial of service, download, execution and update.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

It will then allocate another area of memory in the debugged process in which to inject the code.

Stealth

6 techniques

T1027.002Software PackingEvidence1

Most recent variants also use third party packers to evade antivirus detection and slow down manual reverse engineering.

T1027.007Dynamic API ResolutionEvidence1

All imports are resolved at runtime using hashes instead of the import names.

T1036MasqueradingEvidence1

the use of doubled file extensions (*.JPG.EXE, *.TXT.EXE and so forth) to obfuscate a file's true extension is an old trick

T1055Process InjectionEvidence1

It will then allocate another area of memory in the debugged process in which to inject the code.

T1140Deobfuscate/Decode Files or InformationEvidence1

The second function decrypts more code using the RC4 encryption algorithm and the key 0xDEADBEEF. The third TLS function decrypts the rest of the code before calling the main body of the malware.

T1622Debugger EvasionEvidence1

This is a clever way of altering the behavior of the malware if it is being analyzed with a debugger and if a software breakpoint is put on the first instruction of the TLS.

Credential Access

1 technique

T1056.003Web Portal CaptureEvidence1

The malware is able to hook into various browsers to steal information that is submitted in web forms.

Discovery

1 technique

T1622Debugger EvasionEvidence1

This is a clever way of altering the behavior of the malware if it is being analyzed with a debugger and if a software breakpoint is put on the first instruction of the TLS.

Collection

1 technique

T1056.003Web Portal CaptureEvidence1

The malware is able to hook into various browsers to steal information that is submitted in web forms.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

When communicating with its command and control server, Win32/Napolar uses the HTTP protocol.

T1090.003Multi-hop ProxyEvidence1

The three main ones are to conduct Denial of Service attacks, to act as a SOCKS proxy server, and to steal information from infected systems.

T1105Ingress Tool TransferEvidence1

The bot supports a variety of commands, from information stealing and SOCKS proxying, to denial of service, download, execution and update.

T1573Encrypted ChannelEvidence1

These commands are encrypted using RC4, The bot unique identifier is used as the encryption key.

Impact

1 technique

T1498Network Denial of ServiceEvidence1

The three main ones are to conduct Denial of Service attacks, to act as a SOCKS proxy server, and to steal information from infected systems.

Other

1 technique

T1562Impair DefensesEvidence1

It will iterate through all the running processes and specifically kill any process that has the string “ trusteer ” in it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app13 years ago

hash.sha1●●●●●●●●●●●●View more in app13 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

eset welivesecurity blogNews

Dec 18, 2013

Qadars - a banking Trojan with the Netherlands in its sights

Mentioned in conclusion as another recently emerged banking trojan.

eset welivesecurity blogNews

Sep 25, 2013

Win32/Napolar - A new bot on the block

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.