stealer-log.jpg Size: 63.77 KB  Downloads: 1107

Quote:Naming conventions for individual logs vary from stealer to stealer, but this can include such details as victim country, victim hardware id (HWID), and the date and time of capture.

HWIDs are unique and are used as a security measure by Microsoft when Windows is activated.  They are generated when an OS is first installed.  Date and time details can be used to verify the veracity of the data.

├─ Autofills/

│  ├─ Google_[Chrome]_Default.txt

│  ├─ Google_[Chrome]_Profile1.txt

│  ├─ Microsoft_[Edge]_Default.txt

We input a lot of data into web browsers.  To make this process easier, most now facilitate the auto-filling of data, saving the user considerable time.  This data is stored within the browser for quick and easy recall when required.  Stealer logs will routinely target this data, which can include:

Names and DOBs
Addresses
Contact details (email addresses, telephone numbers etc)
Partial credit card details
Access to this data poses a significant risk.  Threat actors can and will use this gathered information to develop a profile of the victim, making it easier for them to launch successful, socially-engineered attacks.

├─ Cookies/

│  ├─ Google_[Chrome]_Default Extension.txt

│  ├─ Google_[Chrome]_Default Network.txt

│  ├─ Google_[Chrome]_Profile 1 Network.txt

│  ├─ Microsoft_[Edge]_Default Network.txt

│  ├─ Microsoft_[Edge]_Profile 1 Network.txt

│  ├─ Opera Software_Unknown Network.txt

Web browsers will also store temporary files or cookies.  These will contain details about credentialed sessions on the browser, but not password information.  The risk caused by the exposure of this data is that it allows a threat actor to replicate account access, potentially bypassing login details to access more sensitive information.

├─ CreditCards/

│  ├─ Microsoft_[Edge]_Default.txt

Web browsers may also save financial information, for ease of access when making online purchases.  Some stealer malware variants will seek to extract this information.  In this example, unredacted credit card details were saved in the Edge web browser, and extracted in full by the malware.

├─ FileGrabber/

│  ├─ Users/

│  │  ├─ Pauli/

│  │  │  ├─ Desktop/

│  │  │  │  ├─ passwords.txt

Some stealer malware variants possess the ability to extract a victim’s files.  Typically, they will focus on file locations which are common across different devices and likely to hold valuable information, such as Desktop or Documents.  The example above shows the victim had a text file saved on their Desktop, containing their usernames and passwords for various sites.

├─ DomainDetects.txt

This file is generated by the malware.  It reads the extracted information and highlights the most common domains seen in the data.  Threat actors use this analysis to identify logs of interest, i.e. those that are accessing websites and services that are of value or can be exploited further.

├─ ImportantAutofills.txt

This file is generated from parsed data from stored auto-fills.  It seeks to extract data deemed most valuable to a threat actor, which can include sensitive Personally Identifiable Information (PII) and financial data.

├─ InstalledBrowsers.txt

Details all installed browsers, including version information.  Identifying an old browser version could provide a threat actor opportunity to launch attacks using known exploits.

├─ InstalledSoftware.txt

Details all applications installed on a victim device, including version information.  This too has value to a threat actor to identify potential vectors for exploitation.

├─ Passwords.txt

The holy grail for stealer malware.  Passwords are extracted from web browsers and stored in this file, including the site name, username and cleartext password.

This file has the potential to be the most destructive for a victim and highlights the inherent risks in using native browser password storage, rather than more secure and reputable password managers.

├─ ProcessList.txt

This file contains an extract of the running processes at the time of infection.  When used in combination with other gathered data, it can provide a threat actor with the opportunity to attack the device further, by utilising suitable exploits identified through this data.

├─ Screenshot.jpg

Not every stealer malware will do this, but some will take a screenshot of the victims’ screen at the point of infection.  This provides some additional information regarding the victim and their habits and activities.  This would have the potential to capture sensitive information if the victim is within a corporate network, or provide a threat actor with additional material for making blackmail or ransom threats.

screenshot.jpg Size: 86.91 KB  Downloads: 1063

Quote:agrar.nites.rs: api.scase.nites.rs: 79.101.38.237
app.ebol-dev.nites.rs: 79.101.38.237
autoconfig.demo.nites.rs: autoconfig.nites.rs: autodiscover.demo.nites.rs: autodiscover.nites.rs: cpanel.demo.nites.rs: 94.127.7.135
cpanel.nites.rs: 94.127.7.135
cpcalendars.demo.nites.rs: 94.127.7.135
cpcalendars.nites.rs: 94.127.7.135
cpcontacts.demo.nites.rs: 94.127.7.135
cpcontacts.nites.rs: 94.127.7.135
demo.nites.rs: 94.127.7.135
demowaf.nites.rs: 79.101.38.236
dev-edv2.ebolovanje.nites.rs: 79.101.38.237
dev-ekomisija.ebolovanje.nites.rs: 79.101.38.237
dev-reportingserver.nites.rs: 79.101.38.237
dev-reports.nites.rs: 79.101.38.237
doctor-deeops.nites.rs: ebolovanje-api.nites.rs: 79.101.38.237
ehr-deeops.nites.rs: ehr-livekit.nites.rs: ehr-lkturn.nites.rs: elab-ui.nites.rs: 79.101.38.237
elab.grafana.nites.rs: 79.101.38.237
elab.nites.rs: 79.101.38.237
esb.nites.rs: 79.101.38.237
ezdapp-test.nites.rs: 79.101.38.232
ezdapp.nites.rs: 79.101.38.237
ezdviewer.nites.rs: 79.101.38.237
fma-api.nites.rs: 79.101.38.237
fma-s3-api.nites.rs: 79.101.38.237
fma-storage.nites.rs: fma-validation-api.nites.rs: 79.101.38.237
fma-web.nites.rs: 79.101.38.237
ftp.nites.rs: nites.rs. 94.127.7.135
git.nites.rs: 79.101.38.237
harbor.nites.rs: 79.101.38.237
hbapp.nites.rs: 79.101.38.238
hbdb.nites.rs: 79.101.38.238
hbdev.nites.rs: 79.101.38.238
hbtest.nites.rs: hepor.nites.rs: 79.101.38.232
heporapp-deeops.nites.rs: heporapp.nites.rs: 79.101.38.232
jira.nites.rs: 79.101.38.237
landing-deeops.nites.rs: led.nites.rs: livekit-turn.nites.rs: 79.101.38.232
livekit.nites.rs: 79.101.38.232
mail.nites.rs: nites.rs. 94.127.7.135
mantis.nites.rs: 79.101.38.237
nites.rs: 94.127.7.135
nitesgroup.nites.rs: nites.oneassessment.com. 104.26.10.134 104.26.11.134 172.67.70.32
nodesync.nites.rs: 79.101.38.237
owncloud.nites.rs: 79.101.38.237
paperflow.nites.rs: 79.101.38.237
patient-deeops.nites.rs: pepos-dev.nites.rs: 79.101.38.237
pl.nites.rs: 79.101.38.237
qualys.nites.rs: 79.101.38.235
registry.git.nites.rs: 79.101.38.237
reports.ebol-dev.nites.rs: 79.101.38.237
reports.elab.nites.rs: 79.101.38.237
scase.nites.rs: 79.101.38.237
sms.nites.rs: svn.nites.rs: 79.101.38.237
test.paperflow.nites.rs: 79.101.38.237
tiketing.nites.rs: 79.101.38.237
vcapp.nites.rs: 79.101.38.232
videosync.nites.rs: 79.101.38.233
vpn.nites.rs: 93.87.83.246
vuz-oauth.nites.rs: 79.101.38.237
vuz.nites.rs: 79.101.38.237
webdisk.demo.nites.rs: 94.127.7.135
webdisk.nites.rs: 94.127.7.135
webmail.demo.nites.rs: 94.127.7.135
webmail.nites.rs: 94.127.7.135
whm.demo.nites.rs: 94.127.7.135
whm.nites.rs: 94.127.7.135
www.api.scase.nites.rs: 79.101.38.237
www.demo.nites.rs: 94.127.7.135
www.led.nites.rs: www.nites-demo.nites.rs: www.nites.rs: nites.rs. 94.127.7.135
www.scase.nites.rs: 79.101.38.237

• Kompomitovane i/ili napadnute državne resurse kod stranih (i neadekvatnih) provajdera usluga
  
• Kompomitovane državne resurse zajedno sa privatnim
  
• Kompromitovane resurse zajedno sa phishing izvorima
  
• Napadnute i navodno nekompromitovane resurse (DDoS) koji se takođe nalaze u HoneyPot logovima
  
• Moguće "backdoor" ili procurele podatke (Stealer Logs, Database Dumps) kroz vremenske analize na zajedničkim adresama ali različitim tipovima napada
  
• Moguće mrežne segmente i servise koji su najveći izvori curenja podataka
  
• Greške (false positives) i duplikate