{
  "name": "Gomorrah Stealer: An In-Depth Analysis of a .NET-Based Malware",
  "slug": "gomorrah-stealer-an-in-depth-analysis-of-a-net-based-malware",
  "description": "This comprehensive report analyzes Gomorrah Stealer, a sophisticated malware designed to exfiltrate sensitive information from compromised systems. It operates within a malware-as-a-service framework and targets data from web browsers, cryptocurrency wallets, VPNs, and configuration files. The stealer employs advanced evasion techniques, establishes persistence, and uploads stolen data to a remote server. The analysis explores the malware's functionality, data collection processes, anti-analysis measures, and overall impact, providing valuable insights into this evolving threat.",
  "published": "2024-09-16T07:52:21+00:00",
  "created_at": "2024-09-16T07:52:21+00:00",
  "modified_at": "2024-09-16T07:57:34+00:00",
  "created_at_opencti": "2024-09-16T07:52:21+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-16",
    "evasion",
    "exfiltration",
    "gomorrah stealer",
    "malware-as-a-service",
    "persistence",
    "stealer"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "172.93.223.99"
      },
      {
        "id": "",
        "name": "rougecommunications.org"
      },
      {
        "id": "",
        "name": "dc33943da400ea506484952ba242737460c73dd2b3e88c16f0f18a0fd6dc459c"
      },
      {
        "id": "",
        "name": "bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9"
      },
      {
        "id": "",
        "name": "62c6aebb6bcc4d2faf985a4af59b111ae1e162419acfae7e7f126189073bddf1"
      },
      {
        "id": "",
        "name": "2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4"
      }
    ],
    "malware": [
      {
        "id": "dae2ecd3-c6dc-4e9a-804b-b9dd2a23ecf1",
        "name": "Gomorrah Stealer",
        "slug": "gomorrah-stealer"
      }
    ],
    "intrusion_sets": [
      {
        "id": "03a7467e-beea-4b77-94ab-ad55eebe1e77",
        "name": "Lucifer",
        "slug": "lucifer"
      }
    ]
  },
  "external_refs": [
    "https://www.cyfirma.com/research/gomorrah-stealer-v5-1-an-in-depth-analysis-of-a-net-based-malware/",
    "https://otx.alienvault.com/pulse/66e7ffd589d91510a93f7ea3"
  ]
}