Casper
- First seen
- 2014-04-01 00:00:00
- Malware type
- spyware
- Last IoC activity
- 2026-07-15 16:45:04
- Profile updated
- 2026-07-07 14:51:46
Targeted industries: government-and-public-sector
Targeted regions: country_code:sy
Context
ESET describes Casper as a well-developed reconnaissance tool, making extensive efforts to remain unseen on targeted machines. Of particular note are the specific strategies adopted against anti-malware software. Casper was used against Syrian targets in April 2014, which makes it the most recent malware from this group publicly known at this time.
Detection coverage
- 2 YARA rules
Detection rules
- TRELLIX_ARC_Mirai_Casper_Variant (yara-rule)
- MALPEDIA_Win_Casper_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Casper (report)
- ESET — Casper Malware Babar Bunny Another Espionage Cartoon (report)