After collecting documents from removable media,Prikormka compresses the collected files, and encrypts it with Blowfish.^[1]

Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.^[1]

A module inPrikormka collects passwords stored in applications installed on the victim.^[1]

A module inPrikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.^[1]

Prikormka encodes C2 traffic with Base64.^[1]

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.^[1]

Prikormka creates a directory,%USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.^[1]

Prikormka encrypts some C2 traffic with the Blowfish cipher.^[1]

A module inPrikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.^[1]

Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.^[1]

After encrypting its own log files, the log encryption module inPrikormka deletes the original, unencrypted files from the host.^[1]

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.^[1]

Some resources inPrikormka are encrypted with a simple XOR operation or encoded with Base64.^[1]

A module inPrikormka collects information on available printers and disk drives.^[1]

Prikormka contains a module that captures screenshots of the victim's desktop.^[1]

A module inPrikormka collects information from the victim about installed anti-virus software.^[1]

Prikormka uses rundll32.exe to load its DLL.^[1]

A module inPrikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.^[1]

A module inPrikormka collects information from the victim about its IP addresses and MAC addresses.^[1]

A module inPrikormka collects information from the victim about the current user name.^[1]