Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers found over 10,000 distinct samples of the shared OfferLoader component... OfferLoader used a trojanized Inno Setup installer to start the next stages.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
“Each URL contained a click_id parameter: a Base64-encoded fingerprint containing the victim's operating system (OS), browser, the referring domain, the exact search keyword ... and their public IP address.”
“Plus de 200 domaines rotatifs suivant un pattern de nommage en deux mots composés.”
The TTP list identifies T1608.004; campaign funnels direct victims through a PPI gate to payload delivery.
Search-engine optimization, or SEO, poisoning targeted people looking for legitimate utilities... land on a fake file-hosting page... supplying a trojanized archive.
The TTP list identifies T1566 Phishing, while the campaign distributes malicious downloads through deceptive links and promoted software-related content.
The TTP list identifies T1059.001, and t.ps1 is listed among the campaign files.
Gaming channels published real advice about improving frame rates, fixing crashes, and changing settings, then encouraged viewers to download an alleged tool or optimization pack from links in video descriptions.
OfferLoader used a trojanized Inno Setup installer to start the next stages.
Installers that looked like useful software, game tools or performance fixes... a harmless WinRAR lookalike... a trojanized Inno Setup installer.
Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.
The campaign’s gate inspected a fresh click identifier with device, browser, search, referrer, and IP details. Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.
Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.
The campaign’s gate inspected a fresh click identifier with device, browser, search, referrer, and IP details. Genuine visitors received the installer, while automated scanners and researchers often saw a harmless WinRAR lookalike or a broken link.
“Envoie un beacon de tracking à voyagemist[.]space” and “User-agent C2 : insomnia/2023.4.0 Windows.”
“Utilisation de Blogspot comme intermédiaire de redirection sociale.”
OfferLoader used a trojanized Inno Setup installer to start the next stages. After a tracking check, it launched three child processes for separate malware operations.
After a tracking check, it launched three child processes for separate malware operations... [Insomnia RAT] can... download files... The third branch... side-loaded a browser extension.
308 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.