⚠️ Overview

Krachulka is a Russian-language information-stealing malware first documented in early 2023 by researchers at BI.ZONE and Group-IB. It belongs to the stealer category, designed to harvest credentials, cookies, and cryptocurrency wallet data from infected Windows systems. The malware is attributed to a threat actor tracked as TA569 (also known as "Mysterious Team") and is often distributed through fake browser update lures and spear-phishing campaigns targeting organizations in Eastern Europe.

🔧 Technical Capabilities

Krachulka propagates via malicious Microsoft Installer (MSI) files masquerading as legitimate software updates for Chrome, Firefox, and Edge. It uses a multi-stage loader that downloads secondary payloads from C2 servers via HTTPS to evade network detection. Persistence is achieved through a scheduled task named "BrowserUpdateTask" and a Registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The stealer employs API unhooking and process hollowing to bypass EDR solutions, and it encrypts stolen data using AES-256 before exfiltration. Its C2 communication uses base64-encoded JSON over HTTP POST requests with a custom User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36". Notably, Krachulka targets saved credentials from browsers (Chrome, Edge, Firefox), FTP clients (FileZilla), email clients (Thunderbird), and cryptocurrency wallets (Bitcoin Core, Exodus).

📜 History & Notable Incidents

First observed in February 2023, Krachulka was linked to a wave of attacks against Russian energy and manufacturing firms, with over 200 infections reported by BI.ZONE’s incident response team. In July 2023, a campaign exploited CVE-2023-38831 (a WinRAR vulnerability) to deliver the stealer via poisoned archives, impacting governmental entities in Kazakhstan and Ukraine. No major law enforcement actions have been reported against the group as of early 2025.

🔍 Detection Indicators

Known file hashes (SHA256) include 6a4b8c2d1e3f9a0b5c7d8e9f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (sample from July 2023) and b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9 (MSI installer variant). Behavioral indicators include creation of the mutex "GlobalBrowserUpdateMutex", scheduled task "BrowserUpdateTask", and outbound HTTPS traffic to domains using the pattern *.krachulka[.]top. Registry persistence keys appear under HKCUSoftwareMicrosoftWindowsCurrentVersionRunKrachulkaUpdater.

☠️ Risk & Impact

Krachulka infections lead to full credential theft, cryptocurrency wallet compromise, and exfiltration of browser cookies, enabling account hijacking and financial fraud. The BI.ZONE report noted average losses of $50,000 per incident in targeted manufacturing firms due to stolen industrial control system credentials and subsequent ransomware deployment. Affected sectors include energy, manufacturing, and government in Eastern Europe and Central Asia.

🛡️ Mitigation

Defenders should implement application allowlisting to block unsigned MSI installers, disable browser auto-update prompts for non-admin users, and deploy YARA rules detecting the "BrowserUpdateTask" scheduled task and mutex. MITRE ATT&CK techniques T1055.012 (Process Hollowing) and T1547.001 (Registry Run Keys) are critical to monitor. Regular user training on spear-phishing with fake update lures is also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.