General
- Target https://cdn.discordapp.com/attachments/1395122441562361879/1494635290739081298/QUANTUMBOOST.zip?ex=69e35316&is=69e20196&hm=7a762dfe096f9975147d181f9a836fa39b5d8f0f95e2139ed5c32d27f2765e89&
- Sample260417-pepm4adt4r
Score
10/10
Malware Config
Extracted
Family
-
santa_stealer
C2
-
ioc.exchange
-
ruruurururururu.ru
Attributes
-
post_request
fa3c16365fd0d67f6035f379df7a375ebe1aa51e99a2dde0db92c906ed003a70
-
url_path
/api/v1/accounts
-
user_agent
MastodonClient
Targets
-
- Target https://cdn.discordapp.com/attachments/1395122441562361879/1494635290739081298/QUANTUMBOOST.zip?ex=69e35316&is=69e20196&hm=7a762dfe096f9975147d181f9a836fa39b5d8f0f95e2139ed5c32d27f2765e89&
Score10/10Family: SantaStealer
SantaStealer is an information stealer written in C.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Accesses cryptocurrency files/wallets, possible credential harvesting