{
  "name": "Campaign uses infostealers and clippers for financial gain",
  "slug": "campaign-uses-infostealers-and-clippers-for-financial-gain",
  "description": "Kaspersky has uncovered a complex malware campaign orchestrated by Russian-speaking cybercriminals. The threat actors create sub-campaigns mimicking legitimate projects, using social media to enhance credibility. They host initial downloaders on Dropbox to deliver infostealers like Danabot and StealC, as well as clippers. In addition to distributing malware, the campaigns trick victims into providing credentials and linking cryptocurrency wallets to drain funds. The analysis covers three active sub-campaigns involving multistage malware, process injection, and various evasion techniques.",
  "published": "2024-08-16T06:21:22+00:00",
  "created_at": "2024-08-16T06:21:22+00:00",
  "modified_at": "2024-08-16T06:53:25+00:00",
  "created_at_opencti": "2024-08-16T06:21:22+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-16",
    "clipper",
    "cryptocurrency",
    "danabot",
    "evasion",
    "infostealer",
    "injection",
    "phishing",
    "russian",
    "stealc"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "89.169.52.59"
      },
      {
        "id": "",
        "name": "85.28.47.139"
      },
      {
        "id": "",
        "name": "77.91.77.200"
      },
      {
        "id": "",
        "name": "79.133.180.213"
      },
      {
        "id": "",
        "name": "46.8.238.240"
      },
      {
        "id": "",
        "name": "194.116.217.148"
      },
      {
        "id": "",
        "name": "23.94.225.177"
      },
      {
        "id": "",
        "name": "81.19.137.7"
      },
      {
        "id": "",
        "name": "https://tydime.io/api.php'"
      },
      {
        "id": "",
        "name": "dc-mx.bf442731a463.tidyme.io"
      },
      {
        "id": "",
        "name": "yous.ai"
      },
      {
        "id": "",
        "name": "wuwelej.top"
      },
      {
        "id": "",
        "name": "voico.io"
      },
      {
        "id": "",
        "name": "vinrevildsports.shop"
      },
      {
        "id": "",
        "name": "tydime.io"
      },
      {
        "id": "",
        "name": "tidymeapp.io"
      },
      {
        "id": "",
        "name": "tidyme.io"
      },
      {
        "id": "",
        "name": "supme.io"
      },
      {
        "id": "",
        "name": "sinergijiasport.shop"
      },
      {
        "id": "",
        "name": "runeonlineworld.io"
      },
      {
        "id": "",
        "name": "refvhnhkkolmjbg.shop"
      },
      {
        "id": "",
        "name": "peerme.io"
      },
      {
        "id": "",
        "name": "partyroyaleplay.io"
      },
      {
        "id": "",
        "name": "partyroyaleplay.com"
      },
      {
        "id": "",
        "name": "partyroyale.games"
      },
      {
        "id": "",
        "name": "partyroyale.fun"
      },
      {
        "id": "",
        "name": "izxxd.top"
      },
      {
        "id": "",
        "name": "gurunsmilrsports.shop"
      },
      {
        "id": "",
        "name": "edvhukkkmvgcct.shop"
      },
      {
        "id": "",
        "name": "dustfightergame.com"
      },
      {
        "id": "",
        "name": "dintrinnssports.shop"
      },
      {
        "id": "",
        "name": "batverssaports.shop"
      },
      {
        "id": "",
        "name": "astrosounsports.shop"
      },
      {
        "id": "",
        "name": "1h343lkxf4pikjd.dad"
      },
      {
        "id": "",
        "name": "f71bb213ae7abe03e416c650185971c8470c9ab5670e1b2c516d903bc783715b"
      },
      {
        "id": "",
        "name": "f586b421f10b042b77f021463934cfeda13c00705987f4f4c20b91b5d76d476c"
      },
      {
        "id": "",
        "name": "db4328dfbf5180273f144858b90cb71c6d4706478cac65408a9d9df372a08fc3"
      },
      {
        "id": "",
        "name": "ea748caf0ed2aac4008ccb9fd9761993f9583e3bc35783cfa42593e6ba3eb393"
      },
      {
        "id": "",
        "name": "ce0905a140d0f72775ea5895c01910e4a492f39c2e35edce9e9b8886a9821fb1"
      },
      {
        "id": "",
        "name": "d69a93df6cab86b34c970896181bb1b618317e29ca8b5586364256a1d02b7cca"
      },
      {
        "id": "",
        "name": "c990a578a32d545645b51c2d527d7a189a7e09ff7dc02cefc079225900f296ac"
      },
      {
        "id": "",
        "name": "bafa7dbe2a5df97c8574824abd2ae78ffa0991f916e72debc9fc65e593ec2ee8"
      },
      {
        "id": "",
        "name": "b7d3bc460a17e1b43c9ff09786e44ea4033710538bdb539400b55e5b80d0b338"
      },
      {
        "id": "",
        "name": "b4b929362fb797f99f00b3e94b4bed796ae664a31a4dc5f507672687ad44322e"
      },
      {
        "id": "",
        "name": "ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5"
      },
      {
        "id": "",
        "name": "934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c"
      },
      {
        "id": "",
        "name": "9d8547266c90cae7e2f5f5a81af27fb6bc6ade56a798b429cdb6588a89cec874"
      },
      {
        "id": "",
        "name": "8265d6a8eb6c308a7b41cf60ba12f4a7e4616f6acf2736ee42aadcff336659e3"
      },
      {
        "id": "",
        "name": "7d42e121560bc79a2375a15168ac536872399bf80de08e5cc8b3f0240cdc693a"
      },
      {
        "id": "",
        "name": "7fbc872542b61d592eff2aa402d9310dafdb01f550226588e2d95050bac434fc"
      },
      {
        "id": "",
        "name": "7b94558257ff060e0b30d08b3f51b0df6a46458fd5a726f41a48ec5f5675dd8b"
      },
      {
        "id": "",
        "name": "7587be1d73dd90015c6200921d320ff0edcec19d7465b64d8ab8d12767c0f328"
      },
      {
        "id": "",
        "name": "6cc3e6b74d2018ce3d86e6e9df2846a14cc980e8f95779b3ce4e83bb1ccd72bd"
      },
      {
        "id": "",
        "name": "6b30a6026b7cc60a3cce4db9ae2461af86c3a0ec81d29c3397cfad69b7878754"
      },
      {
        "id": "",
        "name": "69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699"
      },
      {
        "id": "",
        "name": "609129a9188ca3d16832594d44d746d7434e67a99c6dd20c1785aface9ed117d"
      },
      {
        "id": "",
        "name": "5e31073312aa132a5c138e3c978ee1f3802a786c23cdf3965bee0d556b360932"
      },
      {
        "id": "",
        "name": "5535bf554c8314b500fb9f00d5bdea0ade884cb7c74536bdaafa501361232e73"
      },
      {
        "id": "",
        "name": "592052016d9621eb369038007ab13b19632b7353fafb65bd39268796d5237c8c"
      },
      {
        "id": "",
        "name": "523d4eb71af86090d2d8a6766315a027fdec842041d668971bfbbbd1fe826722"
      },
      {
        "id": "",
        "name": "4c33d4179fff5d7aa7e046e878cd80c0146b0b134ae0092ce7547607abc76a49"
      },
      {
        "id": "",
        "name": "3e80405991c6fc66f90435472210e1479b646ead3a92bd3f28fba3dd9d640266"
      },
      {
        "id": "",
        "name": "1f3aa94fb9279137db157fc529a8b7e6067cbd1fe3eb13c6249f7c8b4562958a"
      },
      {
        "id": "",
        "name": "142b8d0080db24246615059e4badf439f68c2b219c68c7ac7f4d2fc81f5bb9c2"
      },
      {
        "id": "",
        "name": "0d877b9163241e6d2df2779d54b9eda8abc909f022f5f74f084203134d5866e2"
      },
      {
        "id": "",
        "name": "0891edb0cc1c0208af2e4bc65d6b5a7160642f89fd4b4dc321f79d2b5dfc2dcc"
      },
      {
        "id": "",
        "name": "bc1qqkvgqtpwq6g59xgwr2sccvmudejfxwyl8g9xg0"
      },
      {
        "id": "",
        "name": "1DSWHiAW1iSFYVb86WQQUPn57iQ6W1DjGo"
      }
    ],
    "malware": [
      {
        "id": "4963ee98-a131-4e18-b64b-e10b62974283",
        "name": "DanaBot",
        "slug": "danabot"
      },
      {
        "id": "54a0b340-b33e-4644-8a5a-68eea8cca00d",
        "name": "StealC",
        "slug": "stealc"
      }
    ],
    "attack_patterns": [
      {
        "id": "5bf9eb8e-3111-4054-8317-4b23b4d60ab8",
        "name": "T1179"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "96df92ce-da3e-4c6d-8250-cb250c9ed619",
        "name": "T1554"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "b9a3b4f8-b9c0-4ed8-bf5e-bf759b9804d6",
        "name": "T1564"
      },
      {
        "id": "8b1be248-0f6e-4813-81d3-638fec2a733e",
        "name": "T1559"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "29f7ff93-033b-4f8d-8691-5bcaa438c80f",
        "name": "T1592"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://securelist.com/tusk-infostealers-campaign/113367/",
    "https://otx.alienvault.com/pulse/66bf0c02bc4cb78c8570dc93"
  ]
}