ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Spark

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Spark

NamesSpark
CategoryMalware
TypeReconnaissance, Backdoor, Keylogger, Info stealer, Downloader
Description(Cybereason) The Spark backdoor allows the attackers to:
• Collect information about the infected machine.
• Encrypt the collected data and send it to the attackers over the HTTP protocol.
• Download additional payloads.
• Log keystrokes.
• Record audio using the computer’s microphone.
• Execute commands on the infected machine.

The creators of the Spark backdoor use a few techniques that are intended to keep the backdoor under-the-radar, including:
• Packing the payloads with the Enigma packer.
• Checking for antivirus and other security products using WMI.
• Validating Arabic keyboard and language settings on the infected machine.
Information<https://www.cybereason.com/blog/new-cyber-espionage-campaigns-targeting-palestinians-part-one>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.spark>

Last change to this tool card: 23 April 2021

Download this tool card in JSON format

Previous: Spaceship
Next: Speculoos

All groups using tool Spark

ChangedNameCountryObserved

APT groups

 Molerats, Extreme Jackal, Gaza Cybergang[Gaza]2012-Apr 2021 

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key