Karius
- First seen
- 2018-03-01 00:00:00
- Malware type
- trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 14:50:59
Targeted industries: financial-services
Context
According to checkpoint, Karius is a banking trojan in development, borrowing code from Ramnit, Vawtrack as well as Trickbot, currently implementing webinject attacks only. It comes with an injector that loads an intermediate "proxy" component, which in turn loads the actual banker component. Communication with the c2 are in json format and encrypted with RC4 with a hardcoded key. In the initial version, observed in March 2018, the webinjects were hardcoded in the binary, while in subsequent versions, they were received by the c2.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Karius_Auto (yara-rule)
Reports & references
- securityintelligence.com — From Ramnit To Bumblebee Via Neverquest (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Karius (report)
- dissectmalware.wordpress.com — Multi Stage Powershell Script (report)
- research.checkpoint.com — Banking Trojans Development (report)