Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Related tools tied to the same developer include TheVoidStealer, WallStealer, and Void Miner, suggesting an active and steadily expanding malware portfolio.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Domains T1583.001 dinitro.buzz, bineress.shop via PublicDomainRegistry
MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Server T1583.004 Euro Crypt EOOD bulletproof hosting
MITRE ATT&CK Mapping Technique ID Implementation Command and Scripting Interpreter T1059 Remote shell via get_shell command
MITRE ATT&CK Mapping Technique ID Implementation Direct System Calls T1106 NtOpenKey, NtQueryValueKey, NtCreateFile bypassing ntdll hooks
The fake Cloudflare checkbox copies an obfuscated PowerShell command to the clipboard and instructs the user to open Windows Run, paste, and press Enter.
This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).
key_x38512.exe, keywp.exe and stube.exe share a Rust dropper framework. We recovered their AES-256-GCM keys... before inspecting the decrypted files.
MITRE ATT&CK Mapping Technique ID Implementation Software Packing T1027.002 YONDEXCRYPT#2 crypter
This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).
MITRE ATT&CK Mapping Technique ID Implementation Deobfuscate/Decode Files or Information T1140 Runtime BCrypt AES decryption
MITRE ATT&CK Mapping Technique ID Implementation System Binary Proxy Execution T1218 Chrome process used as decryption oracle for ABE bypass
MITRE ATT&CK Mapping Technique ID Implementation Subvert Trust Controls T1553 Named pipe impersonation of Chrome IPC
MITRE ATT&CK Mapping Technique ID Implementation OS Credential Dumping T1003 DPAPI master key extraction
Recovered strings expose browser-password and cookie collection, autofill and payment-card queries.
Recovered strings expose... screenshots, host profiling, and targeting of Telegram, Discord, Steam, FileZilla and wallet data.
Recovered strings expose browser-password and cookie collection, autofill and payment-card queries, screenshots, host profiling...
The WallStealer binaries contain code for retrieving Steam profile pages and extracting the actual_persona_name field. This makes Steam a dead-drop resolver: the profile name supplies the destination for subsequent malware communication.
The command is designed to download the executable into %TEMP%\u.exe and launch it.
MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567 Telegram Bot API (sendDocument/sendMessage)
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.