{
  "family": "carberp",
  "sample_count": 61,
  "category": "banking_trojan",
  "description": "Trojan:Win32/Carberp is a historically significant, highly sophisticated banking trojan originating from Russia. Notorious for its complex bootkit architecture and extensive Man-in-the-Browser (MitB) capabilities, it caused massive financial damage before its source code leaked in 2013, spawning numerous variants.<br><br><b>Understanding Carberp</b><br>For the victim, a Carberp infection is invisible until their bank accounts are drained. For threat intelligence analysts, Carberp was a pioneer in malware stealth. It was one of the first banking trojans to widely utilize a bootkit (infecting the Master Boot Record or Volume Boot Record) to ensure it loaded into memory before the Windows OS and antivirus software even started, granting it near-total invisibility and persistence.<br><br><b>Execution and Evasion Strategies</b><br>Carberp was primarily distributed via the Blackhole Exploit Kit (drive-by downloads). Upon execution, its primary goal is evasion. It employs a sophisticated rootkit to hide its files, registry keys, and network connections. The bootkit component modifies the VBR (`T1542.003`) to ensure execution upon boot. Carberp injects its core DLLs into `explorer.exe` and browser processes (`iexplore.exe`, `firefox.exe`, `chrome.exe`). It utilizes MitB techniques to intercept HTTP/HTTPS traffic (`T1185`), allowing it to dynamically inject HTML (web injects) into banking sessions to request additional authentication tokens or spoof account balances while secretly draining the account in the background.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud. EDR platforms are critical, as standard AV often fails against the bootkit. EDR will flag the VBR modification and the aggressive hooking of browser APIs (`NtWriteVirtualMemory`, `NtResumeThread`). Network logs will reveal encrypted POST requests to Carberp C2 domains, often transmitting stolen credentials or downloading updated web injects. Memory forensics (Volatility) is absolutely essential to extract the unhooked, decrypted payload from RAM.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1542.003",
    "T1185",
    "T1055",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Pre-OS Boot: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active Man-in-the-Browser interception and prevent further financial data exfiltration.",
    "Do NOT reboot the machine immediately; capture a forensic memory image to extract the active Carberp configuration and web injects from RAM.",
    "Assume all financial portals accessed from the machine are compromised; initiate mandatory password resets and contact relevant banking institutions.",
    "Due to the bootkit capabilities, formatting the hard drive and rebuilding the OS is the only guaranteed method of eradication."
  ],
  "what_to_avoid": [
    "Do not trust any web session initiated from the infected machine; Carberp actively alters the HTML presented to the user.",
    "Avoid relying solely on basic AV removal tools; they frequently fail to eradicate the underlying bootkit persistence mechanism."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}