MalwareUsed by 1 actor

WallStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TheVoidStl

Related tools tied to the same developer include TheVoidStealer, WallStealer, and Void Miner, suggesting an active and steadily expanding malware portfolio.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Domains T1583.001 dinitro.buzz, bineress.shop via PublicDomainRegistry

T1583.004ServerEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Server T1583.004 Euro Crypt EOOD bulletproof hosting

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Command and Scripting Interpreter T1059 Remote shell via get_shell command

T1106Native APIEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Direct System Calls T1106 NtOpenKey, NtQueryValueKey, NtCreateFile bypassing ntdll hooks

Privilege Escalation

1 technique

T1055.002Portable Executable InjectionEvidence1

This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Obfuscated Files or Information T1027 324+ AES-encrypted string constants

T1027.002Software PackingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Software Packing T1027.002 YONDEXCRYPT#2 crypter

T1055.002Portable Executable InjectionEvidence1

This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Deobfuscate/Decode Files or Information T1140 Runtime BCrypt AES decryption

T1218System Binary Proxy ExecutionEvidence1

MITRE ATT&CK Mapping Technique ID Implementation System Binary Proxy Execution T1218 Chrome process used as decryption oracle for ABE bypass

Defense Impairment

1 technique

T1553Subvert Trust ControlsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Subvert Trust Controls T1553 Named pipe impersonation of Chrome IPC

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation OS Credential Dumping T1003 DPAPI master key extraction

T1555.003Credentials from Web BrowsersEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Credentials from Password Stores: Browser T1555.003 Chrome ABE bypass, DPAPI/BCrypt decryption, Firefox DB parsing

Collection

1 technique

T1113Screen CaptureEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Screen Capture T1113 GDI BitBlt + GDI+ PNG encoding

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567 Telegram Bot API (sendDocument/sendMessage)

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app5 months ago

ip.v4●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

May 20, 2026

Void Botnet Uses Ethereum Smart Contracts for Seizure-Resistant C2 Infrastructure

A related malware tool tied to the same developer as Void Botnet. The content only identifies it as part of the same malware portfolio.

breakglass intelNews

Mar 15, 2026

WallStealer: A Full-Featured Infostealer Whose Operator Put Their C2 Domain as Their Steam Display Name - Breakglass Intelligence - Breakglass Intelligence

A 64-bit Windows stealer that steals credentials from Chrome, Edge, Brave, and Firefox, captures screenshots, exfiltrates data via the Telegram Bot API, and includes a remote shell for interactive command execution. It also uses direct NT syscalls for EDR evasion, process injection, and a Chrome App-Bound Encryption bypass via named pipe interception.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

WallStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TheVoidStl

Related tools tied to the same developer include TheVoidStealer, WallStealer, and Void Miner, suggesting an active and steadily expanding malware portfolio.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Domains T1583.001 dinitro.buzz, bineress.shop via PublicDomainRegistry

T1583.004ServerEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Acquire Infrastructure: Server T1583.004 Euro Crypt EOOD bulletproof hosting

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Command and Scripting Interpreter T1059 Remote shell via get_shell command

T1106Native APIEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Direct System Calls T1106 NtOpenKey, NtQueryValueKey, NtCreateFile bypassing ntdll hooks

Privilege Escalation

1 technique

T1055.002Portable Executable InjectionEvidence1

This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Obfuscated Files or Information T1027 324+ AES-encrypted string constants

T1027.002Software PackingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Software Packing T1027.002 YONDEXCRYPT#2 crypter

T1055.002Portable Executable InjectionEvidence1

This is the classic VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread chain (T1055.002).

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Deobfuscate/Decode Files or Information T1140 Runtime BCrypt AES decryption

T1218System Binary Proxy ExecutionEvidence1

MITRE ATT&CK Mapping Technique ID Implementation System Binary Proxy Execution T1218 Chrome process used as decryption oracle for ABE bypass

Defense Impairment

1 technique

T1553Subvert Trust ControlsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Subvert Trust Controls T1553 Named pipe impersonation of Chrome IPC

Credential Access

2 techniques

T1003OS Credential DumpingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation OS Credential Dumping T1003 DPAPI master key extraction

T1555.003Credentials from Web BrowsersEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Credentials from Password Stores: Browser T1555.003 Chrome ABE bypass, DPAPI/BCrypt decryption, Firefox DB parsing

Collection

1 technique

T1113Screen CaptureEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Screen Capture T1113 GDI BitBlt + GDI+ PNG encoding

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567 Telegram Bot API (sendDocument/sendMessage)

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app5 months ago

ip.v4●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

May 20, 2026

Void Botnet Uses Ethereum Smart Contracts for Seizure-Resistant C2 Infrastructure

A related malware tool tied to the same developer as Void Botnet. The content only identifies it as part of the same malware portfolio.

breakglass intelNews

Mar 15, 2026

WallStealer: A Full-Featured Infostealer Whose Operator Put Their C2 Domain as Their Steam Display Name - Breakglass Intelligence - Breakglass Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.