SecuriTricks - stealer

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

A large-scale phishing campaign deploying the latest version of Rhadamanthys stealer (0.7) has been discovered. The campaign, dubbed CopyRh(ight)adamantys, uses copyright infringement claims to target various regions globally. It impersonates numerous companies, mainly from Entertainment/Media and …

phishing

rhadamanthys

Published: November 6, 2024

Downloadable IOCs: 0

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

APT36, also known as Transparent Tribe, is a Pakistan-based threat actor targeting Indian government and military entities. Their campaigns utilize ElizaRAT, a Windows Remote Access Tool that has evolved to enhance evasion techniques and C2 communication. Recent campaigns employ cloud services like…

Published: November 4, 2024

Downloadable IOCs: 23

Crystal Rans0m: Hybrid ransomware with stealer capabilities

Crystal Rans0m is a newly discovered hybrid ransomware family developed in Rust, first observed in September 2023. It combines file encryption with data stealing capabilities, doubling its leverage over victims. The malware targets browser data, Discord tokens, Steam files, and Riot Games data. It …

Published: October 21, 2024

Downloadable IOCs: 5

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

Threat actors are using fake Google Meet web pages as part of the ClickFix campaign to deliver infostealers targeting Windows and macOS systems. The attackers display fake error messages in web browsers, tricking users into executing malicious PowerShell code. The campaign has expanded to impersona…

Published: October 18, 2024

Downloadable IOCs: 0

Credential Flusher Research

This intelligence report describes a technique employed by threat actors to compel victims into entering their credentials into a browser, thereby enabling the credentials to be stolen from the browser's credential store using traditional credential-stealing malware. The method involves launching t…

Published: September 17, 2024

Downloadable IOCs: 8

Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware

This comprehensive report analyzes Gomorrah Stealer, a sophisticated malware designed to exfiltrate sensitive information from compromised systems. It operates within a malware-as-a-service framework and targets data from web browsers, cryptocurrency wallets, VPNs, and configuration files. The stea…

Published: September 16, 2024

Downloadable IOCs: 6

BLX STEALER

Identified as a sophisticated dropper binary designed to deploy an information stealer dubbed BLX Stealer or XLABB Stealer, this malware has been actively promoted on Telegram and Discord platforms. It targets credentials, browser data, cryptocurrency wallets, and other sensitive personal informati…

Published: September 11, 2024

Downloadable IOCs: 5

There's Something About CryptBot: Yet Another Silly Stealer

This report provides an in-depth technical analysis of a new variant of the CryptBot infostealer, dubbed Yet Another Silly Stealer (YASS). It details the delivery chain, involving the MustardSandwich downloader, and dissects the YASS payload's functionalities, including its data gathering, encrypti…

Published: September 11, 2024

Downloadable IOCs: 13

LummaC2 Malware and Malicious Chrome Extension Delivered

In August 2024, eSentire's Threat Response Unit observed a sophisticated attack involving LummaC2 stealer malware and a malicious Google Chrome browser extension. The attack leveraged DLL side-loading to execute a loader delivering the malware and a PowerShell script that installed the extension. T…

Published: September 9, 2024

Downloadable IOCs: 7

Ailurophile Stealer

This analysis examines a newly identified threat dubbed 'Ailurophile Stealer,' a malware designed to compromise victims' systems by extracting sensitive browser data including stored credentials, cookies, and browsing history. The stealer utilizes various techniques like placing malicious files in …

Published: September 9, 2024

Downloadable IOCs: 3

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

This report analyzes Cthulhu Stealer, a malware-as-a-service targeting macOS users to steal credentials and cryptocurrency wallets. It explores the malware's functionality, including prompting users for passwords, dumping keychain data, and exfiltrating stolen information. The analysis compares Cth…

Published: August 23, 2024

Downloadable IOCs: 9

Double Trouble: Latrodectus And ACR Stealer Observed Spreading Via Google Authenticator Phishing Site

The Cyble Research and Intelligence Lab (CRIL) discovered a sophisticated phishing website mimicking Google Safety Centre, designed to trick users into downloading malware. The malware, compromising security and stealing sensitive information, drops two threats: Latrodectus, which maintains persist…

Published: August 20, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21412, CVE-2024-21893

Downloadable IOCs: 15

Ailurophile: G DATA has sighted a new info stealer in the wild

G DATA has detected a novel information-stealing malware, dubbed 'Ailurophile Stealer'. It is a PHP-based stealer offered through a subscription model on its dedicated website. Customers utilize a web panel to generate customized malware variants, specifying features such as the malware name, icon,…

Published: August 19, 2024

Downloadable IOCs: 2

Exploring the D3F@ck Malware-as-a-Service Loader

This report analyzes the D3F@ck Loader, a malware-as-a-service (MaaS) offering orchestrated by an individual going by the alias Sergei Panteleevich. The loader utilizes various evasion techniques, including the use of Extended Validation certificates, Inno Setup installers with custom Pascal script…

Published: August 19, 2024

Linked vulnerabilities : CVE-2024-7593 (CVSS 9.8)

Downloadable IOCs: 4

Multiple Malware Dropped Through MSI Package

An analysis reveals the distribution of malware through an MSI package, specifically SectopRat and Redline stealer. The malware employs techniques like executing malicious scripts, disabling security measures, and establishing persistence through scheduled tasks. It communicates with command-and-co…

Published: August 14, 2024

Downloadable IOCs: 11

Ande Loader Leads to 0bj3ctivity Stealer Infection

In July 2024, eSentire's Threat Response Unit observed a phishing attack leading to a 0bj3ctivity Stealer malware infection. The attack involved a malicious JavaScript file that retrieved and executed Ande Loader and the 0bj3ctivity Stealer. Ande Loader created persistence, downloaded additional pa…

Published: August 12, 2024

Downloadable IOCs: 2

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

This comprehensive technical analysis delves into the intricate workings of an advanced and localized malware campaign employing the RHADAMANTHYS stealer. Dissecting the infection chain, anti-analysis techniques, data theft capabilities, and Command & Control infrastructure, this detailed report sh…

Published: August 5, 2024

Downloadable IOCs: 5

Brief Overview of the DeerStealer Distribution Campaign

A recent cybersecurity investigation uncovered a malware distribution campaign called DeerStealer. The malware was disseminated through counterfeit Google Authenticator websites, tricking visitors into downloading the malicious payload hosted on GitHub. Upon execution, the stealer collects system i…

Published: August 2, 2024

Downloadable IOCs: 28

Threat actor impersonates Google via fake ad for Authenticator

An unknown threat actor created a deceptive advertisement that appeared as if it was from a reputable company, enticing users to click on it and visit a malicious website. The site hosted a digitally signed malicious file disguised as a popular multi-factor authentication application. Upon executio…

Published: July 31, 2024

Downloadable IOCs: 5

Malware Distributed Using Falcon Sensor Update Phishing Lure

CrowdStrike Intelligence uncovered a phishing campaign impersonating CrowdStrike and distributing malicious files containing a Microsoft Installer (MSI) loader. The loader executes the commodity stealer 'Lumma Stealer' packed with 'CypherIt'. This campaign is likely linked to a previous 'Lumma Stea…

Published: July 29, 2024

Downloadable IOCs: 32

Threat Actor Distributes Python-Based Info Stealer Using Fake Update

An unidentified threat actor exploited the July 19, 2024 Falcon sensor content issue to distribute a Python-based information stealer named Connecio. The malware was delivered via a malicious ZIP file masquerading as a Falcon update. Connecio collects system information, browser data, and exfiltrat…

Published: July 29, 2024

Downloadable IOCs: 30

Threat Actor Uses Fake Recovery Manual to Deliver Unidentified Stealer

An intelligence report outlines a campaign where an unidentified threat actor impersonated a Microsoft recovery manual through a malicious Word document containing macros. Upon execution, the macros downloaded a novel stealer now tracked as Daolpu. This stealer targets credentials stored in web bro…

Published: July 24, 2024

Downloadable IOCs: 6

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

This report details a malicious campaign exploiting the CVE-2024-21412 vulnerability in Microsoft Windows SmartScreen to bypass security warnings and deliver malware. Attackers employ crafted links, LNK files, and HTA scripts to download decoy PDFs and shell code injectors, ultimately injecting ste…

Published: July 24, 2024

Linked vulnerabilities : CVE-2024-21412

Downloadable IOCs: 27

Braodo Info Stealer Targeting Vietnam and Abroad

CYFIRMA discovered Braodo Stealer, a Python-based malware active since early 2024, primarily targeting users in Vietnam but also present in the US, Czechia, Germany, Netherlands, Singapore, and the UK. This malware utilizes GitHub and a Singapore-based VPS server to host and distribute its maliciou…

Published: July 15, 2024

Downloadable IOCs: 14

Fake Microsoft Teams for Mac delivers Atomic Stealer

A malvertising campaign lures Mac users into downloading a counterfeit Microsoft Teams installer containing Atomic Stealer, a data-stealing malware. The campaign uses advanced filtering techniques, compromised ad accounts, and decoy pages to deliver unique payloads that bypass security measures. Up…

Published: July 12, 2024

Downloadable IOCs: 6

Increase In The Exploitation Of Microsoft SmartScreen Vulnerability CVE-2024-21412

Cyble analyzes an ongoing campaign exploiting a Microsoft SmartScreen vulnerability to deliver stealers through spam emails. The campaign employs lures related to healthcare, transportation, and tax notices to trick users into downloading malicious payloads. It utilizes techniques like DLL sideload…

Published: July 11, 2024

Downloadable IOCs: 12

Kematian-Stealer: A Deep Dive into a New Information Stealer

This report provides an in-depth analysis of a newly discovered information stealer named Kematian-Stealer, actively developed on GitHub and distributed as open-source software. The malware employs various techniques to collect sensitive data from compromised systems, evade detection, and maintain …

Published: July 10, 2024

Downloadable IOCs: 4

Death Stealer forked from PowerShell Token Grabber

The report analyzes Kematian Stealer, a sophisticated PowerShell-based malware that exfiltrates sensitive data from infected systems. It is a forked version of PowerShell Token Grabber, with added capabilities like GUI builder, anti-analysis features, and stealing WiFi passwords, screenshots, and s…

stealer

2024-07-05

kematian stealer

powershell token grabber

Published: July 5, 2024

Downloadable IOCs: 0

StrelaStealer Resurgence: Tracking a JavaScript-Driven Credential Stealer Targeting Europe

Recent observations indicate a surge in JavaScript spreading StrelaStealer, a credential stealer specifically targeting Outlook and Thunderbird email credentials. While the infection chain resembles previous versions, additional checks have been implemented to avoid compromising systems in Russia. …

Published: June 25, 2024

Downloadable IOCs: 5

Iluria Stealer; a Variant of Another Discord Stealer

Researchers uncover a new malware variant called Iluria Stealer, created by the developer behind Nikki Stealer, utilizing the alias 'Ykg.' Iluria Stealer is designed to steal Discord tokens, browser credentials, and payment information. It employs techniques like obfuscation, process injection, and…

Published: May 24, 2024

Downloadable IOCs: 5

Crimeware report: Acrid, ScarletStealer and Sys01 stealers

This analysis delves into three distinct stealers: Acrid, ScarletStealer, and Sys01. Acrid is a new stealer found in December, employing the 'Heaven's Gate' technique to bypass security controls. ScarletStealer downloads additional executables and Chrome extensions to facilitate data theft. Sys01, …

Published: May 22, 2024

Downloadable IOCs: 5

Code Emulation and Cybercrime Infrastructure Discovery

This report details the analysis of a malspam campaign utilizing the Matanbuchus loader, which involved decrypting strings within the malware through emulation techniques. The investigation pivoted to uncover a Russian bulletproof hosting service, Proton66 OOO, that currently hosts various maliciou…

Published: May 8, 2024

Downloadable IOCs: 76

Stealer Distributed via Crafted Minecraft Source Pack

This report details the operation of the zEus stealer malware, which is distributed through a crafted Minecraft source pack. The malware collects sensitive information from victims' systems, including login credentials, browser data, and cryptocurrency wallets. It employs anti-analysis techniques a…

Published: May 8, 2024

Downloadable IOCs: 23

HijackLoader Updates

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variety of modules for code injection, execution, and evasion techniques. This report analyzes the updated version of HijackLoader, which includes new modules for bypassing Win…

Published: May 7, 2024

Downloadable IOCs: 11

Fletchen Stealer: An Information Stealer with Sophisticated Anti-Analysis Measures

This in-depth analysis examines Fletchen stealer, an advanced information-stealing malware featuring potent anti-analysis capabilities. It explores the malware's tactics for data harvesting from compromised systems, exfiltration methods, and measures to evade detection. The report emphasizes the dy…

Published: April 29, 2024

Downloadable IOCs: 13

Tag: stealer

Attack reports

A Deep Dive into Water Arsenal and Infrastructure

Stealers and backdoors are spreading under the guise of a DeepSeek client

Fake GitHub projects distribute stealers in GitVenom campaign

New wave of targeted attacks of the Angry Likho APT on Russian organizations

Blast from the Past

NOVA: blast from the past

Analysis of Astral Stealer

NOVA - A Well-Forgotten Stealer

Tria stealer targets Android users for SMS exfiltration and financial gain

The ticket that doesn't exist: a new threat discovered - FakeTicketer

InvisibleFerret Malware: Technical Analysis

NetSupport RAT and RMS in malicious emails

BabbleLoader

HawkEye Malware: Technical Analysis

Hello again, FakeBat: popular loader returns after months-long hiatus

CopyRh(ight)adamantys Campaign: Rhadamantys Exploits Intellectual Property Infringement Baits

Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT

Crystal Rans0m: Hybrid ransomware with stealer capabilities

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

Credential Flusher Research

Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware

BLX STEALER

There's Something About CryptBot: Yet Another Silly Stealer

LummaC2 Malware and Malicious Chrome Extension Delivered

Ailurophile Stealer

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

Double Trouble: Latrodectus And ACR Stealer Observed Spreading Via Google Authenticator Phishing Site

Ailurophile: G DATA has sighted a new info stealer in the wild

Exploring the D3F@ck Malware-as-a-Service Loader

Multiple Malware Dropped Through MSI Package

Ande Loader Leads to 0bj3ctivity Stealer Infection

RHADAMANTHYS: In-Depth Analysis of a Sophisticated Stealer Targeting Israeli Users

Brief Overview of the DeerStealer Distribution Campaign

Threat actor impersonates Google via fake ad for Authenticator

Malware Distributed Using Falcon Sensor Update Phishing Lure

Threat Actor Distributes Python-Based Info Stealer Using Fake Update

Threat Actor Uses Fake Recovery Manual to Deliver Unidentified Stealer

Exploiting CVE-2024-21412: A Stealer Campaign Unleashed

Braodo Info Stealer Targeting Vietnam and Abroad

Fake Microsoft Teams for Mac delivers Atomic Stealer

Increase In The Exploitation Of Microsoft SmartScreen Vulnerability CVE-2024-21412

Kematian-Stealer: A Deep Dive into a New Information Stealer

Death Stealer forked from PowerShell Token Grabber

StrelaStealer Resurgence: Tracking a JavaScript-Driven Credential Stealer Targeting Europe

Iluria Stealer; a Variant of Another Discord Stealer

Crimeware report: Acrid, ScarletStealer and Sys01 stealers

Code Emulation and Cybercrime Infrastructure Discovery

Stealer Distributed via Crafted Minecraft Source Pack

HijackLoader Updates

Fletchen Stealer: An Information Stealer with Sophisticated Anti-Analysis Measures