Malware

Hazard Token Grabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204User ExecutionEvidence1

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 User Execution

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware copies itself into the startup location to establish persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware copies itself into the startup location to establish persistence

Stealth

1 technique

T1497.001System ChecksEvidence1

The malware also checks for the disk size of the victim’s system. If it’s below 50GB, it terminates itself. It then reads the following registry keys for identifying the Virtual environment.

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence1

This malware targets over 20 applications with the express purpose of stealing Discord tokens

T1539Steal Web Session CookieEvidence1

This grabber steals cookies and login credentials from the chrome browser only... The Hazard token grabber reads the following registry key: SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY to steal the Roblox studio cookie

T1555Credentials from Password StoresEvidence1

This grabber steals cookies and login credentials from the chrome browser only. The stolen credentials contain Domain, Username, and Password.

Discovery

7 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1007 System Service Discovery

T1057Process DiscoveryEvidence1

The malware configuration also contains Flag variables and a list of programs to terminate during execution

T1087Account DiscoveryEvidence1

The malware uses the API hxxps[:]//discord.com/api/v9/users/@me and appends a Discord authorization token to identify Account information, such as email, mobile, and billing-related details.

T1124System Time DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1124 System Time Discovery

T1497.001System ChecksEvidence1

The malware also checks for the disk size of the victim’s system. If it’s below 50GB, it terminates itself. It then reads the following registry keys for identifying the Virtual environment.

T1518Software DiscoveryEvidence1

The malware then proceeds to scan for the presence of a Discord token protector... To evade this, the malware checks for the presence of certain files such as DiscordTokenProtector.exe , ProtectionPayload.dll, and secure.dat.

T1614System Location DiscoveryEvidence1

Hazard token grabber sends a request to hxxps[:]//ipinfo[.]io/json to identify the victim’s IP and Location. It also finds the victim’s Google Maps Location.

Collection

1 technique

T1113Screen CaptureEvidence1

MITRE ATT&CK® Techniques ... Collection T1113 Screen Capture

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

The malware exfiltrates the data to a Discord channel using webhooks

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Finally, the malware compresses the stolen data and exfiltrates it using webhooks specified by the TA.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

hash.md5●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

hash.md5●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyble blog historicNews

Jun 1, 2022

Hazard Token Grabber - Cyble

Python-based information stealer and Discord token grabber that establishes persistence, performs anti-debug/anti-VM checks, bypasses Discord token protection mechanisms, steals Discord tokens, Chrome cookies and credentials, Roblox cookies, Windows product information, victim IP/location data, and exfiltrates the collected data to Discord via webhooks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Hazard Token Grabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204User ExecutionEvidence1

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Execution T1204 User Execution

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware copies itself into the startup location to establish persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The malware copies itself into the startup location to establish persistence

Stealth

1 technique

T1497.001System ChecksEvidence1

The malware also checks for the disk size of the victim’s system. If it’s below 50GB, it terminates itself. It then reads the following registry keys for identifying the Virtual environment.

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence1

This malware targets over 20 applications with the express purpose of stealing Discord tokens

T1539Steal Web Session CookieEvidence1

T1555Credentials from Password StoresEvidence1

This grabber steals cookies and login credentials from the chrome browser only. The stolen credentials contain Domain, Username, and Password.

Discovery

7 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1007 System Service Discovery

T1057Process DiscoveryEvidence1

The malware configuration also contains Flag variables and a list of programs to terminate during execution

T1087Account DiscoveryEvidence1

The malware uses the API hxxps[:]//discord.com/api/v9/users/@me and appends a Discord authorization token to identify Account information, such as email, mobile, and billing-related details.

T1124System Time DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1124 System Time Discovery

T1497.001System ChecksEvidence1

The malware also checks for the disk size of the victim’s system. If it’s below 50GB, it terminates itself. It then reads the following registry keys for identifying the Virtual environment.

T1518Software DiscoveryEvidence1

T1614System Location DiscoveryEvidence1

Hazard token grabber sends a request to hxxps[:]//ipinfo[.]io/json to identify the victim’s IP and Location. It also finds the victim’s Google Maps Location.

Collection

1 technique

T1113Screen CaptureEvidence1

MITRE ATT&CK® Techniques ... Collection T1113 Screen Capture

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

The malware exfiltrates the data to a Discord channel using webhooks

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Finally, the malware compresses the stolen data and exfiltrates it using webhooks specified by the TA.

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

hash.md5●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

hash.md5●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyble blog historicNews

Jun 1, 2022

Hazard Token Grabber - Cyble

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.