Sunday, January 28, 2024

Masad Clipper And Stealer - Windows Spyware Exfiltrating Data Via Telegram (Samples)



2019-09-25 Juniper. Masad Stealer: Exfiltrating using Telegram 

"Masad Clipper and Stealer" steals browser information, computer files,  and automatically replaces cryptocurrency wallets from the clipboard with its own.
It is written using Autoit scripts and then compiled into a Windows executable.
It uses Telegram to exfiltrate stolen information.

                             Malware Inventory (work in progress)

Links updated: Feb 12, 2023

Hashes

SHA256SHA1MD5
1acf5a461ee16336eb8bbf8d29982c7e26d5e11827c58ca01adac671a28b52ad6001b34c17c122d201613fffd846b056614b66dae03234c2259c474aeb69500423ddeed7
290a1b89517dec10bfd9938a0e86ae8c53b0c78ed7c60dc99e4f8e5837f4f24a32800c10588053813f55bf8c87771311c5f7f38e2df4c1cf093c8373a8f2f194e77b69a2
7937a1068f130a90b44781eea3351ba8a2776d0fede9699ba8b32f3198de045ba2a67b06344e4f1cf85086f6b584316ec53d5e548368f1c4d8f0d908f5f4ff671df5f1da
87e44bca3cc360c64cc7449ec1dc26b7d1708441d471bf3d36cd330db35762942fe5483e6b82220eeeef12e531eb3347fea16ac11082ce517dd23eee335bedfc6bcd8205
cf97d52551a96dacb089ac41463d21cab2b004ba8c38ffc6cb5fb0958ddd34db5b79a15cb61f5260f0b9d807faa160e6d49590e4b5fdf9653eb1ffbdae8cb4f1f2d71747
79aa23c5a25c7cdbaba9c6c655c918dac3d9823ac62ebed9d7d3e94e1eaafc074a279a6b82fe801d3c8be9d16df2ef5623b177040029ab0fd56cd7e493b46a331ef18bd3
03d703f6d341be258ac3d95961ff0a67d4bf792f9e896530e193b091dca29c2ea9740352af2c9cc926deba7dffc452f213f7f05fa462aac76def5b53351b3b1ddb41124c
a368b6755e62e5c0ff79ea1e3bd146ee8a349af309b4acf0558a9c667e78293ae16167ab646381c277c2ca84319ceb57bacb2c92c4cdc7665adb1cda5897d4df4a560f88
ba933cefbe9a8034f0ba34e7d18481a7db7451c8ef4b6172fb0cad6db0513a5100749407e97085af470c75ef004f2235d30af44fc26a3f2317507a09d91014469b045384
3ba3c528d11d1df62a969a282e9e54534fb3845962672ad6d8bbc29cb6d062f5b8100890c0f1894544b3f99168377ec46c38e9114a0607b4488cd539b8b0b443abd121e3
b763054180cd4e24c0a78b49055ad36dbc849f1a096cddf2db8cee0b9338c21d7bec99308ce4bf409417b642cd9432000a5c19d22dfb1d606e5539399aa1a536baafd2f8
d5ce4b04b7eec6530a4a9d40510177468fadc235253e5a74530a8c9d990f3c5027fc204ffa42262b7570b6fccb435d4d38a3610fc5d8b73da810646407c333fe52186281
965a5949d8f94e17ebcd4cb6d0a7c19f49facbfc1b1c74111e5ceb83550d6c8f7698584b2e7c62061447a6a2583ed6957180c205e7ebe4411664672359b393f530fc2fc1
44134b9d4b10d94f6381b446a1728b116d62e65c1a52db45235af12caf7e38c0fd114077927d501606575ba9ab38ecfb3407d432a4388980d7e3539d74a950dab23d00ac
848d76a227f4fe282b7ddfd82a6dfc4c25da2735a684462b42fe4e1c413d8e34135cee7610890497183eb6251efef307ea013fe17bb23077b4f80df48b91b425eda05828
5ca0a957fe6c253827f344da4ba8692d77a4e21a1df4251594be2d27d87dd8aed231874332ca462fb462e4f68450d2c2c22d4bcddda77b3f3f74a2bdffd167917686e139
016fa511f6546ed439d2606c6db8821685a99f5a14ef3f710668b58dc89c69265c83749c62ee0131710bf26931cb1e463a8fbda3b0c34df85677d8f752dc1e1a5eeba0c9
22be594fbfa878f631c0632f6c4d260b00918817ff66a1f9f15efe44c1a58460856d635fca52631305f1fefc58eafa74496524b660ebf41953d5c6e212fc306cdb0c6519
f3571ec66288405dab43332ca03812617f85fb08832fbbe1f1d89901fe034b8a819485e20d841195e2e8a7ae5b41ff709887bb216984d37863c08b9fdd969297d35d3538
04c949eca23103b1de05278b49f42c3ab6b06f4bf20aafa5f2faefaa84c16ecd0487db2df1802dd4ee4ae3b62b5f08937dd5c77c4366ee61cbd7e636aea8540836a60036
d6fc04acda8f33a6d35eb577c27754c2f2b4d6f4869576c7c4e11b2c5e9b017683ae89826114662dad8553d5eeed5217b57047f22bc964e294d7ab314c34e5934d91a5a9
18c0bd4dd98008383fc52045ad896449fa7f0037593bb730ed1ef88aa547006dbcaa05b60a9d625852ac4f2d0d805ab16498815535d9f08c39c4cf396427f3a345e5c09a
4c9d5469e9095813418260045c2b11e499e4eaa0ffb25293f90f580c464157df4c6aacc0b893ed366f9f307326e59efa61e5153450dddaf7e5bb24aabf66eecd0c8b79cf
0b5f1fbc05dc8baca492b748adeb01fb4904e02723b59211ecde222f7b12d91e87f898e0d41c0f2c22d4e9278a942326877fc368da780b72140535d4c2d391e76dc8181d
31ad5c4547ceae4d0550c8460524c16a6105afc056760e872c4966656256c9dc37f485d3fa8f6cf13061cb1ea38ae0d5d2edfd95134aefcf640c24a1ab5344a96150fb05
edb00a0e5ff70e899857549e3263c887a799416c8bbab43ab130ca1be9bbd78c42c30dc551a3cb3bc935c0eae79b79f17942e439c2722241f765d2ad4fb58edd76a4adea
96f852b81760a425befaa11ea37c0cdea2622630bf2a0c94bb95042211ab614d5d9782064bc38d40c88f32c0410479cbd61caa40f332cfcda8c0ef579ede59eff23caa1e
57fd171a5b1a88e9583b42439851a91a940eb31105ab29cb314846da2ed43b820bfec2059823b936d782bea7bc16abd9923dddb56fff82df7a565b4570d299486697310f
277018b2cc6226dca6c7678cac6718c8584f7231340ad8cd7c03477559fdf48b261f916ce97ffc6817a4772705df68e6ccca8181009dc7d8766a85d85bb6a26ee69b66fe
e968affb1fc7756deb0e29807a06681d09a0425990be76b31816795875469e3dcf78484a999183324da9affdf2aaeff508d1dc473e1b8f6313447b8a4b49671ddeb8a4ee
4b1ccf6b823ee82e400ba25b1f532cd369d7e536475a470e2011b77ffeaf7bb3bc988f7cd32d411f2a9888afc72c7a892e2a1def55128a3da6f70129acdbf9dbe955cfe7
fc84d6636a34ad1a11dbaa1daec179e426bdcd9887b3d26dc06b202417c08f951df31bec02e35c9a4656bb3a3bdf631bb37605a855d77ab16377a8a314982f723fcc6fae
9ca15f15fbae58cb97b0d48a0248461e78e34e6d530338e3e5b91f209a1662678505dfaad6d10b84c73544eb748d547cb5bad9bdebc12c530dab0a65c37ffd72612fa705
31f3a402c1662ed6adffbf2b1b65cf902d1df763698eb76d21e4e94b4c62971418c972722d984ff6da2bc26a0aca4c7f209cc39c05bbf6e72b5b24c0c81e0671bf17b1e7
8d9f124ddd69c257189f1e814bb9e3731c00926fc2371e6ebe2654f3950ca02e553cd98c83e945ee3013aa40897baec0305b34a2b4030025e039c54c2d3923057447494c
a0923d7645604faaa864a079adeb741a5d6e65507a2819b2fee4835d396077d9f8e6995e28c789d8b24e982ac53d5d6ba453de73b796f85c8a7de71407d6e3c4206edda3
a19b790ea12f785256510dde367d3313b5267536a58ca0c27dbdac7c693f57e1a92f7393daf7ead9a44b12e35f850705798fc879a6defec886d31f6375712466dd794a96
f030fb4e859ee6a97c50c973a73dced3640befe37f579cfd15367ce6a9bbede2ad3a1e779f02539ccd07bff735e0823add9730b2c259564a8fe72333604a5686e30f6242
f01db6d77ac21211992ceae4e66e1e03c1cb39d61e03645b9369f28252ca769314c6bf63ff4d32d8a0a42e81ea39304fb7ab13c880fe593ef5538fbf66b3b3e1cb7b9b8b
dfe3d0e95feaed685a784aed14d087b019ba2eb0274947a840d2bdbae4ae36742107d057478328df8f538102508de00b0c4b37c7b5a85a0e7a2c4197c3794c8bb2eb5763
bf6083040ca51e83415f27c9412d9e3d700bd0841493b207bc96abf944ab0ca709a695ce6c35c029dd7577e29f403d7144698b417a2edceb31a9c0d05e5f13c6caee0576
b154151dc8ace5c57f109e6bb211a019db20c4f0127c4d13c7703f730bf492768c0cda049c85493df4e97db3db4ddc94075ba62cb6a895ac5ba5b6472680d47410a238a5
6bf6b1bde63cee9b81902efd187fdd56ecee5853754ce0a19d5ab5c3b02429886e2d4f0bcc97ce130ae89647f648d3e96548a391a29f9d176b913e7f693355700aaadbb9
0dcf547bd8f4074af97416d8b84ea64b2f3319064aa4bce64ad0c2e2d3957175a996b925e9391a69140caf6e4adba928694ffe66dd575413a40839f2807593aa21c71152
6cff1249cc45b61ce8d28d87f8edc6616447e38168e610bed142f0b9c46ea6849baa823deb9075e8df77b891115c019244de09de488bb5c0739485721182c01a82b01d14
5b5ebe019806885bbaafe37bc10ca09549e41c240b793fd29a70690a5d80b4963d46711f9064b96ff2d0affdef1ecd82d120659db95e2d8a8509ac05f5445d18d32cc7cb
103d87098c9702cab7454b52869aeeb6a22919f29a7f19be7509255ce2d8c83ee29a163488438c9ea9014ddf1a9b2d382cc5d7e6baf2587fafaedbab4a78b9b7fd8b55f8
c73675005a09008bc91d6bc3b5ad59a630ab4670dca6ac0d926165a3ecfd8d92d8ea2280cd06a5cc32b7d668e2b4b2e68f3a7e2a98ecc6fbb2cb5649daf751fcbfb81bcb
ef623aadd50330342dc464a31b843b3d8b5767d62a62f5e515ac2b380b208fbe620ff5a7aaf7f3fcf4abc9365e0e77b3ec4b434db14535c5835c9dfb3cbbc7f6fef6034c

Related posts


  1. What Is Hacking Tools
  2. Pentest Tools For Ubuntu
  3. Hack Tools Github
  4. Pentest Tools Bluekeep
  5. Hack And Tools
  6. Hacker Tools 2019
  7. Hacking Tools Windows 10
  8. Hack Tools Online
  9. Hacker Tools For Pc
  10. Hacker Tools For Pc
  11. Pentest Tools List
  12. Hacking Tools Kit
  13. Hacking Apps
  14. Hack Tool Apk
  15. Hackrf Tools
  16. New Hack Tools
  17. Install Pentest Tools Ubuntu
  18. Best Hacking Tools 2020
  19. Hacker Tools Windows
  20. Wifi Hacker Tools For Windows
  21. Hacking Tools Windows
  22. Best Hacking Tools 2020
  23. New Hack Tools
  24. Hack Tools For Ubuntu
  25. Hacker Tool Kit
  26. Hacker Tools For Pc
  27. Blackhat Hacker Tools
  28. Hack Rom Tools
  29. Hacks And Tools
  30. Hak5 Tools
  31. Pentest Tools For Ubuntu
  32. Pentest Tools Tcp Port Scanner
  33. Pentest Tools Framework
  34. Hak5 Tools
  35. Hacking Tools For Kali Linux
  36. Hacking Tools Mac
  37. Hacking Tools Online
  38. Pentest Tools Url Fuzzer
  39. Nsa Hacker Tools
  40. Hacker Tools Free Download
  41. Pentest Tools For Ubuntu
  42. Usb Pentest Tools
  43. Easy Hack Tools
  44. How To Hack
  45. Pentest Tools Linux
  46. Hack Tools For Windows
  47. Pentest Tools Apk
  48. Hacker Tools For Ios
  49. Hacking App
  50. Hacks And Tools
  51. Hacking Tools And Software
  52. Underground Hacker Sites
  53. Hack Tool Apk
  54. Tools For Hacker
  55. Hacker Tools
  56. Android Hack Tools Github
  57. Pentest Tools Nmap
  58. Pentest Recon Tools
  59. Beginner Hacker Tools
  60. How To Install Pentest Tools In Ubuntu
  61. Pentest Tools Port Scanner
  62. Pentest Tools Alternative
  63. Pentest Tools
  64. Hacking Tools Kit
  65. Nsa Hacker Tools
  66. Pentest Tools Url Fuzzer
  67. Pentest Tools Linux
  68. Hacking Tools Windows
  69. Pentest Box Tools Download
  70. Pentest Tools Alternative
  71. Hacker Tools 2019
  72. Hack Rom Tools
  73. Hacking Tools For Pc
  74. Computer Hacker
  75. Hack Tools Mac
  76. Hack Tools For Ubuntu
  77. Hacking App
  78. Hackrf Tools
  79. Pentest Box Tools Download
  80. Android Hack Tools Github
  81. Hacker Tools List
  82. Hacking Tools Mac
  83. How To Install Pentest Tools In Ubuntu
  84. Blackhat Hacker Tools
  85. Tools For Hacker
  86. Tools Used For Hacking
  87. Pentest Tools Free
  88. Hack Tools For Windows
  89. Hacking Tools Windows
  90. Tools For Hacker
  91. Hacker Tool Kit
  92. Hacker Hardware Tools
  93. Hacking Tools For Games
  94. Pentest Tools Port Scanner
  95. Pentest Tools
  96. Best Hacking Tools 2020
  97. Hacker Tools For Pc
  98. Pentest Tools Open Source
  99. Hacker Tools Linux
  100. Hacking Apps
  101. Hacker Tools List
  102. Pentest Tools Website Vulnerability
  103. Pentest Tools Online
  104. Hack Tools For Games
  105. Hacking Apps
  106. Nsa Hack Tools
  107. Hack Tools Online
  108. Pentest Tools Linux
  109. Wifi Hacker Tools For Windows
  110. Pentest Tools Bluekeep
  111. Hacking Tools
  112. Hacking Tools For Windows
  113. Hack Tools Online
  114. Pentest Tools Free
  115. Hacker Tools Software
  116. Hack Tools For Windows
  117. Nsa Hacker Tools
  118. Pentest Tools Android
  119. Hacking Tools Online
  120. Pentest Tools Kali Linux
  121. Pentest Tools Framework
  122. Pentest Tools Port Scanner
  123. Hacker Techniques Tools And Incident Handling
  124. Pentest Tools For Android
  125. Hacking Apps
  126. Pentest Tools Apk
  127. Hacker Hardware Tools
  128. Tools For Hacker
  129. Hacking Tools For Windows Free Download
  130. Hacking Tools Name
  131. Hacker Tools 2020
  132. Hacker Techniques Tools And Incident Handling
  133. What Is Hacking Tools
  134. Hacking Tools Windows 10
  135. Wifi Hacker Tools For Windows
  136. Blackhat Hacker Tools
  137. Hack App
  138. Pentest Tools For Ubuntu
  139. Hacker Tools For Mac
  140. Hacks And Tools
Posted by at No comments:

Cynet's Keys To Extend Threat Visibility

 


We hear about the need for better visibility in the cybersecurity space – detecting threats earlier and more accurately. We often hear about the dwell time and the time to identify and contain a data breach. Many of us are familiar with IBM's Cost of a Data Breach Report that has been tracking this statistic for years. In the 2021 report, IBM found that, on average, it takes an average of 212 days to identify a breach and then another 75 days to contain the breach, for a total of 287 days.

A new solution overview document provides insights on how XDR provider Cynet tackles the difficult problem of greatly improving threat visibility. Cynet takes a modern approach that includes a greater level of native technology integration and advanced automation purposely designed for organizations with smaller security teams than Fortune 500 organizations. A live webinar will discuss the same topic (Register here)

Cynet's Keys for Threat Visibility

Einstein said that the definition of insanity is doing the same thing over and over while expecting a different outcome. The old approach to threat visibility involving multiple protection technologies and trying to sift through a sea of alerts and information is obviously not working well. Cynet's different – and seemingly saner – approach to prevent, detect, and respond to modern-day threats involves several integrated capabilities.

According to the new Cynet solution overview, the following key technologies are used to provide extended threat visibility along with enhanced response capabilities.

Include Multiple Threat Detection Technologies

Cynet includes multiple prevention and detection technologies, all natively orchestrated in the platform:

  • NGAV – Fundamental endpoint protection based on known bad signatures and behaviors.
  • EDR – To detect and prevent more complex endpoint threats that bypass NGAV solutions.
  • NTA – To detect threats that have made their way into the network and so-called lateral movement.
  • UBA – To detect unusual activity that could signal stolen credentials, a rogue insider, or bots.
  • Deception – To uncover intrusions that have bypassed other detection technologies
  • CLM – To mine the extensive log data generated by IT systems.
  • SSPM – To find and correct configuration errors in SaaS applications.

Coordinate All Signals

Making sense out of multiple detection technologies by integrating, coordinating, and prioritizing information was supposed to be the realm of Security Incident and Event Management (SIEM) technologies. Unfortunately, SIEM doesn't do well with real-time data and requires significant care and feeding.

XDR solutions, like Cynet's, are purpose-built to integrate real-time signals from multiple points of telemetry on a single platform. Cynet even includes an Incident Engine that automatically investigates threats to determine the attack's full scope and root cause.

Automate All Response Actions

Quickly and accurately identifying threats is a game-changer. The ability to automatically and fully eradicate identified threats is, well, a game-changer changer. This means security teams won't have to be burdened with lengthy investigations, which many don't have the time or skills to undertake. Cynet provides an extensive set of remediation actions across files, hosts, networks and users as well as remediation playbooks that can be configured to be invoked manually or automatically.

Provide Full MDR Oversight

Beyond the technology platform, Cynet offers all clients a full, 24x7 MDR service at no additional cost. This team continuously monitors client environments to ensure nothing dangerous is overlooked or mishandled. Having an expert team watching out for issues should put smaller organizations with smaller security teams at ease, knowing an expert team of cybersecurity experts has their backs.

In With the New

With the time required to identify and contain data breaches steadily increasing, we need to rethink the traditional cybersecurity approach. It seems companies keep throwing more money, more technology, and more bodies at the problem, yet achieving the same (or worse) results. Cynet is one company that seems to be approaching the problem differently by combining multiple prevention, detection, response, and automation capabilities on a single, unified breach protection platform. Rather than buying all this stuff separately and munging it all together, the Cynet platform seems to expand and improve threat visibility out of the box.

Download the solution brief here

Related articles
Posted by at No comments:

Saturday, January 27, 2024

Ask And You Shall Receive



I get emails from readers asking for specific malware samples and thought I would make a mini post about it.

Yes, I often obtain samples from various sources for my own research.

 I am sometimes too lazy/busy to post them but don't mind sharing.
If you are looking for a particular sample, feel free to ask. I might have it.

Send MD5 (several or few samples). I cannot provide hundreds/thousands of samples or any kind of feeds. If you ask for a particular family, I might be able to help if I already have it.

Unfortunately, I do not have time to do homework for students and provide very specific sets for malware with specific features as well as guarantee the C2s are still active.  Send your MD5(s) or at least malware family and I check if I have it :) If i have it, I will either send you or will post on the blog where you can download.

If you emailed me in the past and never got an answer, please remind me. Sometimes emails are long with many questions and I flag them to reply to later, when I have time and they get buried or I forget. It does not happen very often but accept my apologies if it happened to you.

Before you ask, check if it is already available via Contagio or Contagio Mobile.
1. Search the blog using the search box on the right side
2. Search here https://www.mediafire.com/folder/b8xxm22zrrqm4/BADINFECT
3. Search here https://www.mediafire.com/folder/c2az029ch6cke/TRAFFIC_PATTERNS_COLLECTION
4. Search here https://www.mediafire.com/folder/78npy8h7h0g9y/MOBILEMALWARE

Cheers,  Mila

Related articles


Posted by at No comments: