Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
S2W Talon has named these malware samples BetaSeed (backdoor), AlphaSeed (backdoor), GoBear (backdoor) and Troll Stealer, respectively, based on the chronological order of their discovery.
S2W Talon has named these malware samples BetaSeed (backdoor), AlphaSeed (backdoor), GoBear (backdoor) and Troll Stealer, respectively, based on the chronological order of their discovery.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
The SGA Solutions installer file is confirmed to be signed with a valid D2innovation Co., LTD certificate.
The group primarily uses spear-phishing attacks to distribute malware and attempt to take over accounts to harvest data.
Uses the systeminfo command to gather system information.
Steals specific files located on the C drive, including SSH and FileZilla data.
Performs HTTP communication to exfiltrate the stolen information.
Troll Stealer exfiltrates stolen information to a hard-coded C&C server within the malware.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.