Dark Caracal has obfuscated strings in

Bandook by base64 encoding, and then encrypting them.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Dark Caracal's version of

Bandook adds a registry key to

Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Dark Caracal spearphished victims via Facebook and Whatsapp.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Dark Caracal collected file listings of all default Windows directories.(Citation: Lookout Dark Caracal Jan 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1437.001|Web Protocols|

Dark Caracal controls implants using standard HTTP communication.(Citation: Lookout Dark Caracal Jan 2018) |