The Thin Line: Educational Tools vs. Malicious Threats – A Focus on The-Murk-Stealer – CYFIRMA

MITRE Techniques

• [T1566] Phishing – The initial access (TA0001) occurs through malicious tooling and social-technical delivery, as noted: “The initial access gained through these malicious tools serves as a steppingstone for more severe cyber-attacks.”
• [T1204.002] Malicious File – The builder creates the malicious stealer binary used for deployment: “The interface for the builder … finally builds the binary which an attacker uses for deploying in victim’s environment.”
• [T1059.001] PowerShell – The malware uses PowerShell for data collection and key extraction: “The End function is responsible for preparing the collected data and initiating the exfiltration process.”
• [T1548.002] Bypass User Account Control – The stealer bypasses UAC to elevate privileges: “It bypasses antivirus detection and elevates privileges … It employs a method called UAC bypass…”
• [T1497] Virtualization/Sandbox Evasion – Anti-analysis and anti-debugging measures to evade analysis: “anti-analysis mechanisms … in a controlled environment (e.g., virtual machines, known debugging environments).”
• [T1498] Execution Guardrails – Uses blacklists to avoid analysis and known research environments: “loads various blacklisted data from URLs. These blacklists contain identifiers associated with virtual machines, debugging tools, specific hardware, software, or known analysis environments.”
• [T1555.003] Credentials from Web Browsers – Steals browser credentials and data: “covertly acquires critical data from users’ web browsers, including login credentials, cookies, and browsing history.”
• [T1081] Credentials in Files – Accesses credentials stored in files (e.g., FTP config): “decrypts encrypted FTP credentials from the FileZilla FTP client …”
• [T1083] File and Directory Discovery – Grabs targeted files across drives and creates directories: “grabs files from the victim’s system … organizing them into a designated folder.”
• [T1082] System Information Discovery – Collects comprehensive system data: “gathers general system-related data, such as system information, product keys, Wi-Fi details, and clipboard content.”
• [T1113] Screen Capture – Takes screenshots and stores them: “Automates data collection including screenshots.”
• [T1115] Clipboard Data – Extracts clipboard contents: “clipboard content … saved to a text file.”
• [T1119] Automated Collection – Orchestrates data collection in sequence: “Main: Serves as the main orchestrator, calling the other functions in a sequential manner to execute the entire data collection process.”
• [T1041] Exfiltration Over C2 Channel – Exfiltrates data to remote servers and platforms: “upload the stolen information to a remote server” and “gofile.io” hosting.
• [T1048] Exfiltration Over Alternative Protocol – Uses messaging platforms for exfil: “send a message containing the download link … to Discord Webhook, Telegram, XMPP.”