Malware: Prikormka

Description

[Prikormka](https://attack.mitre.org/software/S0113) is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. (Citation: ESET Operation Groundbait)

External References

• mitre-attack
• ESET Operation Groundbait

Techniques Used by This Malware

• T1016 — System Network Configuration Discovery
• T1025 — Data from Removable Media
• T1027.013 — Encrypted/Encoded File
• T1033 — System Owner/User Discovery
• T1056.001 — Keylogging
• T1070.004 — File Deletion
• T1074.001 — Local Data Staging
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1113 — Screen Capture
• T1120 — Peripheral Device Discovery
• T1132.001 — Standard Encoding
• T1218.011 — Rundll32
• T1518.001 — Security Software Discovery
• T1547.001 — Registry Run Keys / Startup Folder
• T1555 — Credentials from Password Stores
• T1555.003 — Credentials from Web Browsers
• T1560 — Archive Collected Data
• T1573.001 — Symmetric Cryptography
• T1574.001 — DLL