Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“KILLNET now has access to Titan Stealer” and “Recently Titan Stealer also got associated with KILLNET.”
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The binary (stage 1) then uses a process-hollowing technique to inject itself into a legitimate target process called "AppLaunch.exe."
The binary (stage 1) then uses a process-hollowing technique to inject itself into a legitimate target process called "AppLaunch.exe."
Titan Stealer Features: The code is completely self-written Collection of 70+ browsers Collection of 70+ crypto wallets (in development) Powerful File Graber | Collection of 70+ browsers Collection of 70+ crypto wallets (in development)
The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers... The malware collects various types of logs from the infected machine, including browser information such as credentials, cookies, and history...
The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files.
The malware attempts to read all the files in the "User Data" folder of various browsers using the CreateFile API... The FindFirstFileW API... can be used to enumerate all the files in a directory, including hidden files.
Titan Stealer Features: The code is completely self-written Collection of 70+ browsers Collection of 70+ crypto wallets (in development) Powerful File Graber
Titan Stealer Features: The code is completely self-written Collection of 70+ browsers Collection of 70+ crypto wallets (in development) Powerful File Graber | Collection of 70+ browsers Collection of 70+ crypto wallets (in development)
Titan Stealer transmits information to a command and control server using base64 encoded archive file formats as shown in Figure 8 below.
Titan Stealer transmits information to a command and control server using base64 encoded archive file formats as shown in Figure 8 below.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.