هدف قراردادن ۴۰ مرورگر وب و ۷۰ افزونه مرورگر توسط یک بدافزار جدید به نام Mystic Stealer

?? ????? ??????? ?????? ????  ???? ????? ?? ??????? ???? ??????? ???? ?? ??? Mystic Stealer ??? ??? ??? ?? ??????? ???? ?? ?????? ?? ????? ? ??? ?? ?? ?????? ?????? ?? ?? ???? ??????.

??? ??????? ???? ????????? ?? ?? ????? ???? ?? ???? ??? ???? ?? ??? ????? ?? ? ??? ??????? ????????? Steam ? ?????? ?? ??? ??? ???? ?????? ? ?? ??????????? ????????? ???? ?????? ?? ????? ???????????? ??????? ??????.

?????? InQuest[1] ? [?]Zscaler ?? ?????? ?? ???? ????? ????? ??? ?? ??? ???? ?????: «??? ?? ?? ??????? ?? ????????? ???????? ??????????? ?? import??? ????? ?? hash? ? ???????? ???? ????? ???????? ?? ??? ???? ???.»

Mystic Stealer? ????? ?????? ???? ?? ?????????? ????????? ????? ?? ???? ???? ????? ???????? ?? ???? ??????? ????? ???? ? ?? ???? ???????????? C ?????????? ??? ??? ? ????? ??? ?? ?? ??????? ?? ?????? ??????????? ???.

??????????????? ??? ??????? ?? ?? ???? ???? ?? ????? loader ?????? ?? ?? ?? ????? ?????? ?? payload??? ????? ???? ?? ?? ?? ?? ???? ????? ? ????? fetche ??? ???? ??????? ? ???? ??? ? ?? ?? ?? ?? ????? ??????? ????? ??????.

???????? C2 ?? ??????? ?? ?? ?????? ?????? ?????? ??? TCP ?? ??? ??????. ?? ?? ????? ?? ???? C2 ??????? ??????? ??? ???. ??? ????? ???? ?? ???? ???? ???????? ???? ???? ???????? Stealer ???? ?????? ?? ????????? ???? ? ???? ??????? ??? ??????.

???? ????? ?????? Cyfirma ?? ???????????? ??????? Mystic ?? ????? ???[?]? ???: “??????? ??? ????? ?????? ?? ???? ?? ????? ??????? ??????? ?? ?????????? ??? ???? ???????? ????? ?? ??? Stealer ???? ??????.”

?????? ????????: «?? ??? ???? ??? ?? ??????????? Mystic Stealer ?? ????? ????? stealer  ??????? ?? ???? ???? ???? ??????? ??? ? ????????? ???? ?????? ?? ?? ????? ? ???? ????? ????? ???.»

??? ???????? ?? ???? ?? ??? ??????? ?? ?????? ????????[?] ???????? ?? ????? ???[?] ?? ?????? ???????? ???? ???????[?]? ? ???? ???????? ????? ?? ????? ???????? ????????????? ???? ????? ?????? ????? ?? ???????? ??? ??? ???????.

?????????????? ?????? ???????? ??????? ???? ???? ?????? ?????? ???? ?????????? ?????????? ???????? ???? ?? ?? ????? ????????? ? ????? ???? ???? ???????? ??????? ???????.

?? ???? ?????? ???????? ?????????? ??? off-the-shelf ?? ???????? ????????????? ?? ????? ???? ???????? ?? ??????? ?????? ?? ?? ??? ??? ????? ???? ?????? ?? ??? ????? ????? ?? ???????? ???? ? ????????? ?????????? ?? ???? ????? ?? ??? ????? ???????? ????.

????? ????? ?? ??? ????? ? ???? stealer ?? ?????? ??? ?? ????? ????? ???? ??? ???? ????? Album Stealer? Aurora Stealer? Bandit Stealer? Devopt? Fractureiser ? Rhadamanthys ?? ??? ??? ???? ???? ???? ??? ???.

?? ????? ????? ?? ???? ???????? ????? ???? ???? ?? ???????? ????? ??????? ? ?????????? ?????? ?? ??? ??? ????????????? ?? ?????????? ????? [?]AceCryptor? [?]ScrubCrypt (????? ?? BatCloak) ? [?]Snip3 ?????? ???????.

??? ????? ?????? ????? ????? ?????? ?? HP Wolf Security ?? ????? ChromeLoader[10] ?? ???? ???? ?? ??? ??? Shampoo ?? ??? ???? ???[??] ?? ???? ??? ?? ?????? ??????? ???? ?? Google Chrome ? ???? ???????? ????? ????? ???? ??????? ? ????? ??????? ?? ?????? ?????? ????? ??? ???[??].

Jack Royer? ???? ??????? ?? ??? ???? ???[??]: «??????? ?????? ?? ???? ?????? ?????? ?????????? ????? ??????? (Cocaine Bear.vbs)? ???????? ??????? ?? ????? ????? ?? ??????? ????? ????. ??? ?????????? ???????? ?? ???? ??????? ?? ?? VBScript ???? ?? ??? ?????????? ???? ??? ???? ???? ?? ???? ????? ?????? ????? ??????.»

??? VBScript ???? ?? ?????????? ?? PowerShell ?????? ?? ???????? ???? ????????? ???? ????? ?? ????? ??? ? ?? ??????? ?? ??????? ?? ????? “–load-extension” [??]?? ???? ???? ?? ?????? ???? ????????? ???? ??? ???.

??? ?????? ?? ????? ??? ?? ?????? ??????? ?????? ???? ?? ??? Pikabot ??? ?? ??????? ????? ??????? ?????? ? ????? ?????? ?????? ???? ???? C2 ????? Cobalt Strike [??]?? ????.

??? ??????? ?? ?? ????? ??? ???? ???? ???? ????????? ??????? ?????? ???????? ? ???????? ??????? ?????????? ?? [??]QBot ????? ????? ????? ???? ???? ?????? ??? ?? ??????? ???? ?????.

Zscaler ?? ??? ???? ???[??]: «Pikabot ?? ??????? ??????? ???? ??? ?? ?????? ????????? ?? ????????? ?? ???????????? ?? ?????????? ?????? ? ?????????? ??? ???? ???? ?? ???? ???????? ?? ????? ? ????? ?????????? ????? ??? ?????? ????? ??????.»

?????

[?] https://inquest.net/blog/2023/06/15/mystic-stealer-new-kid-block

[?] https://www.zscaler.com/blogs/security-research/mystic-stealer

[?] https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware

[?] https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web

[?] https://thehackernews.com/2023/05/new-stealthy-bandit-stealer-targeting.html

[?] https://thehackernews.com/2023/04/youtube-videos-distributing-aurora.html

[?] https://thehackernews.com/2023/05/acecryptor-cybercriminals-powerful.html

[?] https://thehackernews.com/2023/06/cybercriminals-using-powerful-batcloak.html

[?] https://www.zscaler.com/blogs/security-research/snip3-crypter-reveals-new-ttps-over-time

[??] https://thehackernews.com/2022/05/experts-warn-of-rise-in-chromeloader.html

[??] https://press.hp.com/us/en/press-releases/2023/hp-wolf-security-q1-2023-threat-insights-report.html

[??] https://thehackernews.com/2023/02/chromeloader-malware-targeting-gamers.html

[??] https://threatresearch.ext.hp.com/shampoo-a-new-chromeloader-campaign

[??] https://apa.aut.ac.ir/?p=9566

[??] https://thehackernews.com/2023/05/hackers-using-golang-variant-of-cobalt.html

[??] https://thehackernews.com/2023/06/evasive-qbot-malware-leverages-short.html

[??] https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot

[??] https://thehackernews.com/2023/06/new-mystic-stealer-malware-targets-40.html

??????? :
???? ??????
???? :
????????? ???? ??????? ????? ???? ????

پویش #دو_درجه_کمتر