Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PluginName – in this example, the plugin is called Pillager.
A modified version of the Pillager utility stands out among the tools the attackers deployed on hosts to gather sensitive information. This tool is used to export and decrypt data from the target computer.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacks also involve an extensive reconnaissance phase... with the threat actor engaging in Active Directory enumeration, credential theft by targeting the LSASS process and the NTDS database file...
The primary types of data collected by this utility include ... Credentials stored and used by the operating system, and Wi‑Fi network credentials
The primary types of data collected by this utility include: Saved credentials from browsers, databases, and administrative utilities like MobaXterm
The attacks also involve an extensive reconnaissance phase following initial compromise and persistence, with the threat actor engaging in Active Directory enumeration...
User and group information : query user nslookup quser
Network information : ping - n netstat - ano arp - a net share
System information enumeration : The attacker initially gathered basic system information by using the following commands: systeminfo ipconfig / all tasklist / svc
Directory listing : dir \\c$ dir \\c$\inetpub dir \\c$\inetpub\custerr dir \\c$\inetpub\wwwroot\
The campaign includes extensive reconnaissance, Active Directory enumeration, and credential theft.
The attackers used the deployed agents to conduct reconnaissance and collect sensitive data, such as browser history, text files, configuration files, and documents with .doc, .docx and .xlsx extensions.
Next, the attackers utilized automation tools such as stealers and credential-harvesting utilities to collect sensitive data.
The malware collects data into CSV files, which it then archives and saves as CheckOutData.zip in a specially created directory named CheckOut.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.