Okrum

Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.^[1]

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.^[1]

To establish persistence, Okrum can install itself as a new service named NtmSsvc.^[1]

Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. ^[1]

Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.^[1]

Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.^[1]

Okrum uses HTTP for communication with its C2.^[1]

Okrum was seen using a RAR archiver tool to compress/decompress data.^[1]

Okrum was seen using MimikatzLite to perform credential dumping.^[1]

Okrum has used base64 to encode C2 communication.^[1]

Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.^[1]

Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.^[1]

Okrum's loader can create a new service named NtmsSvc to execute the payload.^[1]

Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.^[1]

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.^[1]

Okrum was seen using a keylogger tool to capture keystrokes. ^[1]

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.^[1]

Okrum's installer can attempt to achieve persistence by creating a scheduled task.^[1]