Okrum

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.(Citation: ESET Okrum July 2019)

Okrum uses HTTP for communication with its C2.(Citation: ESET Okrum July 2019)

Okrum was seen using a RAR archiver tool to compress/decompress data.(Citation: ESET Okrum July 2019)

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.(Citation: ESET Okrum July 2019)

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.(Citation: ESET Okrum July 2019)

To establish persistence, Okrum can install itself as a new service named NtmSsvc.(Citation: ESET Okrum July 2019)

Okrum has used base64 to encode C2 communication.(Citation: ESET Okrum July 2019)

Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.(Citation: ESET Okrum July 2019)

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. (Citation: ESET Okrum July 2019)

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.(Citation: ESET Okrum July 2019)

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.(Citation: ESET Okrum July 2019)

Okrum was seen using a keylogger tool to capture keystrokes. (Citation: ESET Okrum July 2019)

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.(Citation: ESET Okrum July 2019)

Okrum was seen using MimikatzLite to perform credential dumping.(Citation: ESET Okrum July 2019)

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.(Citation: ESET Okrum July 2019)

Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.(Citation: ESET Okrum July 2019)

Okrum's installer can attempt to achieve persistence by creating a scheduled task.(Citation: ESET Okrum July 2019)

Okrum's loader can create a new service named NtmsSvc to execute the payload.(Citation: ESET Okrum July 2019)

Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.(Citation: ESET Okrum July 2019)