{
  "family": "casper",
  "sample_count": 8,
  "category": "trojan",
  "description": "Casper is a sophisticated espionage Trojan heavily linked to the advanced persistent threat (APT) group known as Animal Farm (or Babar). Discovered in the mid-2010s, Casper primarily targets governmental organizations and research institutions. The malware acts as a first-stage reconnaissance and staging tool, leveraging zero-day vulnerabilities (such as Adobe Flash exploits) to infiltrate target networks. Once executed, Casper employs advanced evasion techniques, including environmental checks to detect virtualization, sandboxes, and specific antivirus engines, effectively preventing analysis. It systematically gathers system metadata, network configuration, and user credentials, wrapping the data in custom encryption before exfiltrating it to hardcoded Command and Control (C2) servers. A notable feature of Casper is its structural resemblance and shared code components with other Animal Farm tools like Babar and Bunny, confirming its role in a broader, state-sponsored cyber espionage campaign characterized by high operational security and bespoke development.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Babar-Casper",
    "Animal Farm Casper"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Casper malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Casper is a specialized espionage trojan attributed to the Animal Farm APT group, used for system profiling and staging."
      }
    },
    {
      "@type": "Question",
      "name": "Who are the primary targets of Casper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets government entities, geopolitical institutions, and research organizations."
      }
    },
    {
      "@type": "Question",
      "name": "How does Casper avoid detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It employs rigorous anti-analysis and anti-sandbox checks, only executing fully on physical, non-research systems."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities does it exploit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Historically, Casper has been dropped via zero-day vulnerabilities in software like Adobe Flash."
      }
    },
    {
      "@type": "Question",
      "name": "How is it related to Babar?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Casper shares significant code similarities and C2 infrastructure patterns with Babar, another tool by the same APT."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1497.001",
    "T1189",
    "T1082"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Casper binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Casper installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "ESET Research - Casper: The Quiet Animal Farm Reconnaissance Tool",
      "url": "https://www.welivesecurity.com/2015/03/05/casper-malware/"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2014-0515 Overview",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0515"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2014,
  "motivation": "Espionage",
  "threat_actors": [
    "Animal Farm",
    "Babar Group"
  ],
  "target_geographies": [
    "Europe",
    "Middle East"
  ],
  "target_industries": [
    "Government",
    "Defense",
    "Diplomatic",
    "Research"
  ],
  "lineage": {
    "derived_from": [
      "animal_farm_toolkit"
    ],
    "variants": [
      "babar",
      "bunny",
      "tafaseel"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2014-0515",
    "CVE-2014-1776"
  ],
  "iocs": {
    "file_hashes": [
      "0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0",
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
    ],
    "delivery": [
      "Watering hole attacks compromising Syrian and European government web portals",
      "Targeted zero-day Adobe Flash exploits (CVE-2014-0515) delivered via strategic web compromise"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsSecurityHealthService",
      "Injection of malicious payload DLLs into svchost.exe processes via process hollowing"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}