Malware

KuinaExtractor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence2

Privilege escalation fodhelper / ms-settings in early builds; SilentCleanup in later builds UAC-bypass attempts are a strong sign the infection is more than a nuisance download.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The latest build wraps its strings in 28-byte XOR encryption, ships its own certificate roots instead of relying on the system’s trusted store...

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

The earliest builds already targeted more than ordinary browser cookies. Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

T1555Credentials from Password StoresEvidence2

Later versions added Windows Credential Manager collection... A user may need to secure Discord, Steam, Roblox, crypto wallets, Telegram data, FileZilla credentials, Windows saved credentials, and accounts that were opened in the affected browser.

T1649Steal or Forge Authentication CertificatesEvidence2

Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The January rewrite also added extensive reconnaissance before any data theft began. Eight hardware queries using WMIC, WiFi network enumeration... and victim IP geolocation all ran ahead of the main theft routine.

T1082System Information DiscoveryEvidence2

Windows collection Windows Credential Manager dump, WMIC hardware queries, Wi-Fi SSID enumeration

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

GitHub was used both as a delivery host and as disposable remote infrastructure through GitHub Actions. That infrastructure role with GitHub remains active today.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

In the January branch, exfiltration moved from a Discord webhook to a Telegram bot. By June... uses a one-way Telegram channel for file upload.

Other

1 technique

T1562Impair DefensesEvidence2

Defender tampering Loop that disables Microsoft Defender in the January rewrite

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app25 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

trojan killer newsNews

Jul 6, 2026

TimbreStealer Hides Behind Edge and Google Update DLLs

Referenced as another malware involved in browser data theft.

trojan killer newsNews

Jun 28, 2026

KuinaExtractor Rebrands as k0to While Stealing Browser Data

A Rust-based infostealer focused on credential and session theft. It steals browser data, Discord tokens, Steam and Roblox sessions, crypto wallet data, Windows-stored credentials, and later added Windows Credential Manager collection, Wi-Fi SSID enumeration, anti-analysis features, Defender tampering, UAC-bypass attempts, and Telegram-based exfiltration.

cyber security newsNews

Jun 26, 2026

KuinaExtractor Uses Telegram Exfiltration, UAC Bypass, and Sandbox Detection for Stealth

A Rust-based infostealer that steals browser data, cryptocurrency wallet data, and credentials from popular services. Over time it added Chrome App-Bound-Encryption bypass, Telegram-based exfiltration, multiple UAC bypass techniques, reconnaissance, Microsoft Defender disabling attempts, string encryption, custom certificate roots, and sandbox detection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

KuinaExtractor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence2

Privilege escalation fodhelper / ms-settings in early builds; SilentCleanup in later builds UAC-bypass attempts are a strong sign the infection is more than a nuisance download.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The latest build wraps its strings in 28-byte XOR encryption, ships its own certificate roots instead of relying on the system’s trusted store...

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

The earliest builds already targeted more than ordinary browser cookies. Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

T1555Credentials from Password StoresEvidence2

T1649Steal or Forge Authentication CertificatesEvidence2

Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

T1082System Information DiscoveryEvidence2

Windows collection Windows Credential Manager dump, WMIC hardware queries, Wi-Fi SSID enumeration

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

GitHub was used both as a delivery host and as disposable remote infrastructure through GitHub Actions. That infrastructure role with GitHub remains active today.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

In the January branch, exfiltration moved from a Discord webhook to a Telegram bot. By June... uses a one-way Telegram channel for file upload.

Other

1 technique

T1562Impair DefensesEvidence2

Defender tampering Loop that disables Microsoft Defender in the January rewrite

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app25 days ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

trojan killer newsNews

Jul 6, 2026

TimbreStealer Hides Behind Edge and Google Update DLLs

Referenced as another malware involved in browser data theft.

trojan killer newsNews

Jun 28, 2026

KuinaExtractor Rebrands as k0to While Stealing Browser Data

cyber security newsNews

Jun 26, 2026

KuinaExtractor Uses Telegram Exfiltration, UAC Bypass, and Sandbox Detection for Stealth

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.