Raccoon Stealer

Volt Typhoon has obtained the victim's system current location.

Selon Group-IB, les cybercriminels s’appuient également sur ... la prise de contrôle de médias sociaux pour disséminer les logiciels malveillants.

All of these networks use search engine optimization to put a “bait” webpage on the first page of results for search engine queries seeking “crack” versions of a variety of software products.

Des premiers opérateurs sont chargés de diriger du trafic web vers des sites usurpant l’identité d’entreprises connues, pour convaincre les victimes de télécharger des fichiers malveillants.

Raccoon Stealer has been distributed through cracked software downloads.

Scattered Spider’s powerful initial access tactics ... include phone calls, SMS phishing, email phishing, MFA fatigue attacks, and SIM swapping. The domains used for email and SMS phishing abuse the Okta and Zoho ServiceDesk brands combined with the target’s name to make them appear legitimate.

It downloads 7 legitimate third-party DLLs from the C2 server, using GET requests, in the following order: sqlite3.dll freebl3.dll mozglue.dll msvcp40.dll nss3.dll softokn3.dll vcruntime140.dll

The download was a .zip archive file named after the alleged “cracked” product sought by the target.

Les cybercriminels intègrent par exemple des liens permettant de télécharger des malwares dans des critiques de jeux populaires ou dans des loteries sur les médias sociaux.

Completing the download resulted in the delivery of a malware payload.

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

Des sites usurpant le nom d’entreprises connues ... pour convaincre les victimes de télécharger des fichiers malveillants.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

The strings in the real second-stage dropper includes a number of anti-analysis checks, looking for virtual machine artifacts, tools used for web traffic analysis, and other sandboxing tools.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

Grandoreiro can steal cookie data and credentials from Google Chrome... Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers.

Une fois les victimes infectées, les cybercriminels peuvent avoir accès aux mots de passe ... Group-IB recommande ... de ne pas enregistrer ses mots de passe dans son navigateur.

The content repeatedly describes threat actors and malware stealing usernames, passwords, cookies, session tokens, and other saved credentials from web browsers such as Chrome, Firefox, Internet Explorer, Edge, Opera, Safari, and Yandex.

their only post being about troubleshooting a credential checker that they were using to validate credentials they stole.

The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking admin status, and enumerating user sessions.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

The strings in the real second-stage dropper includes a number of anti-analysis checks, looking for virtual machine artifacts, tools used for web traffic analysis, and other sandboxing tools.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

Meanwhile, the real second-stage installer is calling home to retrieve yet another payload.

ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.