Loading malware…
OxideHarvest is a Rust-based credential-stealing malware tool associated with a Gentlemen ransomware affiliate, particularly the operator tracked as quant, and also known by the alias buildx641. It is used as part of post-compromise collection activity rather than as a core payload of the Gentlemen operators themselves. The malware is designed to harvest credentials and related data from Chromium-based and Gecko-based web browsers on compromised Windows systems. Reported targets include major Chromium-family browsers and Firefox-derived browsers, indicating broad coverage of stored browser secrets across enterprise and consumer environments.
Available reporting characterizes OxideHarvest as a credential stealer that accepts runtime parameters including connection and output options, then extracts browser-stored data for operator use. In addition to browser credential harvesting, it has been described in intrusion activity as a custom credential and data collector leveraging shadow-copy access and extraction of Active Directory credential material, including NTDS and SYSTEM hive data, indicating utility in both local credential theft and domain-focused post-exploitation. The malware has been linked to ransomware intrusion workflows in which stolen credentials support follow-on privilege escalation, lateral movement, and broader compromise objectives.
OxideHarvest is not assessed to be an in-house Gentlemen development; instead, it is attributed to an affiliate-maintained tool integrated into that ecosystem. Its observed role aligns with credential access and collection during ransomware operations targeting organizational environments.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gentlemen also uses OxideHarvest, a credential stealer maintained by one of the group’s affiliates.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Defense Evasion T1027 Obfuscated Files or Information Some executables are protected with packers (Enigma, Themida) and custom control-flow obfuscation.
Stealth T1036 Masquerading Gentlemen’s EDR killers are protected by impersonating legitimate vendors through filenames, version information, icons, and copied digital certificates.
Additionally, ESET documented the use of OxideHarvest, a Rust-based credential-stealer tool...
Credential Access T1003.001 LSASS Memory KslDump, KslKatz, Velociraptor LSASS collection
Credential Access T1003.003 NTDS ntds.dit extraction via buildx641/OxideHarvest
ESET said it also detected a Rust-based credential stealer codenamed OxideHarvest (aka buildx641) that's capable of harvesting data from popular web browsers, including Google Chrome, Microsoft Edge, Torch, Comodo, Epic Privacy Browser, Vivaldi, Brave, Opera, OperaGX, Mozilla Firefox, Waterfox, BlackHawk, and IceCat.
ESET also found a Rust-based credential stealer called OxideHarvest, also tracked as buildx641, linked to one of the group’s affiliates. It targets Chrome, Edge, Firefox, Brave, Opera, OperaGX, Vivaldi, Waterfox, and a dozen other browsers, using supplied credentials to log into specified hosts, pull browser credentials, and write them to an output file.
The gang also uses OxideHarvest, a Rust-written credential stealer maintained by a Gentlemen affiliate, which harvests credentials from Chromium-based and Gecko-based browsers across compromised hosts.
Collection T1560 Archive Collected Data Large-volume data exfiltration (hundreds of GB to TBs)
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.