Meet Kraken: Targeting windows’ emerging botnet

In late October 2021, ZeroFox Intelligence disclosed a botnet called Kraken. Kraken propagates through SmokeLoader, scaling up each time the attack infrastructure is updated. Despite having the same name as the Kraken botnet discovered in 2008, they have nothing in common.

function

The Kraken botnet has been actively developing against Windows since October 2021. Although the functionality of the bot is relatively simple, the attackers are constantly updating. Its typical functions are as follows:

Persistence

Collect host information

Download and execute the program

Remote command execution

Steal cryptocurrency wallets

Screenshots

“Open Source” Beginnings

An earlier version of Kraken was uploaded to GitHub on October 10, 2021, and the source code for that version predates any samples. But it’s unclear whether the code on GitHub was part of the attackers, or if the attackers simply exploited the code for development.

infect

Kraken propagates in a self-extracting RAR SFX file downloaded by SmokeLoader. The SFX file contains a UPX-packed Kraken, a RedLine Stealer, and a program for removing Kraken. Subsequent versions used THEMIDA for packing in addition to UPX.

Persistence

Kraken moves itself to %AppData%Microsoft. File names are hard-coded, such as taskhost.exe, Registry.exe, and Windows Defender GEO .exe.

To persist in hiding, Kraken runs the following two commands:

powershell -Command Add-MpPreference -ExclusionPath %APPDATA%\Microsoft

attrib +S +H %APPDATA%\Microsoft\

The name of the registry key value is another hard-coded value, the early version was called Networking Service, and later networking5 Servic1e, Networking5r Servirc1er, etc. were used.

What remains unchanged in each release is:

ID: Obfuscated UUID

INSTALL: Installation timestamp

LAST: Empty

NAME: Obfuscated file and run key

REMASTER：nil

VERSION：0.5.6

features

Kraken’s functionality is still very simple compared to other botnets, mainly passing information about the trapped host back to the C&C server. The information collected is as follows:

host name

The user name

Build ID (TEST_BUILD_ + timestamp of the first run)

CPU information

GPU information

Operating system and version

Kraken was originally only used to download files for functions such as updating bots, performing Payload, and receiving files, but has been merged into one in the latest version.

Attackers had also added SSH blasting capabilities, but this was quickly removed. The C&C server sends the ScreenShot command, and the sample takes a screenshot of the system.

The most recently added feature is stealing cryptocurrency wallets:

%AppData%\Zcash

%AppData%\Armory

%AppData%\bytecoin

%AppData%\Electrum\wallets

%AppData%\Ethereum\keystore

%AppData%\Exodus\exodus.wallet

%AppData%\Guarda\Local Storage\leveldb

%AppData%\atomic\Local Storage\leveldb

%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb

The currently supported commands are:

Position

ScreenShot

SHELL

UPLOAD

control panel

Since October 2021, the Control Panel has been updated with many versions. Although the source code on GitHub contains the code of the C&C server, it does not contain the Control Panel.

Kraken

The original panel was the Kraken panel, which provided basic statistics, uploading and downloading Payloads, and interacting with bulk managed hosts.

Anubis

The current control panel is the Anubis panel, which provides much more information than the original panel. You can view historical command records with information about the victim.

The Anubis panel adds the ability to select targets to execute in subsequent updates, which gives you more granular control over the targets of attack.

As the Kraken botnet continues to grow in size and other information theft and mining programs are being deployed, botnet mining revenue is about $3,000 a month.

conclusion

Kraken’s activity was once attenuated, but in a short time, it would enable new ports or new C&C servers. By monitoring commands, attackers focus on deploying information stealers, specifically RedLine Stealer.

MITRE ATT&CK

ID	Description
T1027.002	Obfuscated Files or Information: Software Packing
T1033	System Owner/User Discovery
T1047	Windows Management Instrumentation
T1059.001	Command and Scripting Interpreter: PowerShell
T1059.003	Command and Scripting Interpreter: Windows Command Shell
T1082	System Information Discovery
T1113	Screen Capture
T1132.001	Data Encoding: Standard Encoding
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1571	Non-Standard Port