Malware

Invicta Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The infection begins with a spam email with a deceptive HTML page designed to appear as an authentic refund invoice from GoDaddy, aiming to trick the recipients.

Execution

2 techniques

T1059.001PowerShellEvidence1

When the user opens this .LNK file, it triggers a PowerShell command that runs a .HTA file hosted on the TAs Discord server. This HTA file contains VBScript code that, in turn, executes a PowerShell script.

T1204User ExecutionEvidence1

Inside the “Invoice.zip” archive file, there is a shortcut file named “INVOICE_MT103.lnk”. When the user opens this .LNK file, it triggers a PowerShell command that runs a .HTA file hosted on the TAs Discord server.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

To obscure the reversing process, the stealer employs several techniques. The developers utilize encrypted strings to conceal important information, and crucial operations are executed using SYSCALLS, making it harder to analyze the code.

Credential Access

2 techniques

T1528Steal Application Access TokenEvidence1

To accomplish this, the stealer enumerates three specific paths within the system. This enumeration aims to confirm the installation of Discord and, if it is indeed present, proceed with the extraction of its data.

T1555Credentials from Password StoresEvidence1

Following the extraction of Steam data, the stealer then shifts its focus towards targeting the KeyPass password manager.

Discovery

3 techniques

T1010Application Window DiscoveryEvidence1

Upon execution, the stealer collects an extensive array of system information. This includes details such as the computer name, system username, system time zone, system language, operating system version, and names of running processes.

T1082System Information DiscoveryEvidence1

T1083File and Directory DiscoveryEvidence1

Following the enumeration of installed applications, the stealer advances towards stealing files from the Desktop and Documents folders.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The stealer targets the following browsers to steal information... leveldb folder, autofill data, cookies, credit card details, downloads, browsing history, keywords, and login data.

T1560Archive Collected DataEvidence1

Once the necessary enumerations are completed, the stealer progresses to create a compressed zip file that encapsulates all the stolen files residing in memory. This zip file is generated within the system’s temporary folder and is assigned a random name, which has the hardware ID of the victim’s system for identification purposes.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

After successfully completing the data theft process, the stealer proceeds to carry out the next step by sending the stolen data to the designated C&C server or Discord webhook.

T1105Ingress Tool TransferEvidence1

The PowerShell script is responsible for downloading an extremely malicious Invicta Stealer disguised as “Invoice_MT103_Payment.exe”.

INDICATORS OF COMPROMISE

IOCs tracked for this family

30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

30 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 year ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

hash.sha1●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyble blog historicNews

May 25, 2023

Invicta Stealer Spreads Via Fake GoDaddy Refund Invoices

An information-stealing malware promoted via social media and distributed with a free builder. It collects system and hardware information, steals Discord data, cryptocurrency wallet data, browser credentials and cookies, Steam information, password manager data, installed application details, and files from Desktop/Documents, then compresses and exfiltrates the stolen data to a Discord webhook/C2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching30

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Invicta Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The infection begins with a spam email with a deceptive HTML page designed to appear as an authentic refund invoice from GoDaddy, aiming to trick the recipients.

Execution

2 techniques

T1059.001PowerShellEvidence1

T1204User ExecutionEvidence1

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

Credential Access

2 techniques

T1528Steal Application Access TokenEvidence1

T1555Credentials from Password StoresEvidence1

Following the extraction of Steam data, the stealer then shifts its focus towards targeting the KeyPass password manager.

Discovery

3 techniques

T1010Application Window DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

T1083File and Directory DiscoveryEvidence1

Following the enumeration of installed applications, the stealer advances towards stealing files from the Desktop and Documents folders.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The stealer targets the following browsers to steal information... leveldb folder, autofill data, cookies, credit card details, downloads, browsing history, keywords, and login data.

T1560Archive Collected DataEvidence1

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

After successfully completing the data theft process, the stealer proceeds to carry out the next step by sending the stolen data to the designated C&C server or Discord webhook.

T1105Ingress Tool TransferEvidence1

The PowerShell script is responsible for downloading an extremely malicious Invicta Stealer disguised as “Invoice_MT103_Payment.exe”.

INDICATORS OF COMPROMISE

IOCs tracked for this family

30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

30 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 year ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

hash.sha1●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyble blog historicNews

May 25, 2023

Invicta Stealer Spreads Via Fake GoDaddy Refund Invoices

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching30

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.