{
  "name": "Iluria Stealer; a Variant of Another Discord Stealer",
  "slug": "iluria-stealer-a-variant-of-another-discord-stealer",
  "description": "Researchers uncover a new malware variant called Iluria Stealer, created by the developer behind Nikki Stealer, utilizing the alias 'Ykg.' Iluria Stealer is designed to steal Discord tokens, browser credentials, and payment information. It employs techniques like obfuscation, process injection, and command-and-control communication. The report provides an in-depth analysis of the malware's functionality, infrastructure, and recommendations for mitigation.",
  "published": "2024-05-24T06:36:39+00:00",
  "created_at": "2024-05-24T06:36:39+00:00",
  "modified_at": "2024-05-24T06:55:49+00:00",
  "created_at_opencti": "2024-05-24T06:36:39+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-24",
    "credentials",
    "discord",
    "epsilon stealer",
    "iluria stealer",
    "nikki stealer",
    "stealer"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "api.nikkistealer.shop"
      },
      {
        "id": "",
        "name": "nikkistealer.shop"
      },
      {
        "id": "",
        "name": "b66ce85c6942855970fe939a31459e5b7489e6d2c4bbe0d9d89cb8a863082e1c"
      },
      {
        "id": "",
        "name": "8681456f3f5829f67a2d429b7095715b1b65a7be1aa5e90b9ec5945aa22a099b"
      },
      {
        "id": "",
        "name": "865d5423ec49f96d005cb0b1561a966d8b66f3f2fec7f10a8738d97ffb711990"
      }
    ],
    "malware": [
      {
        "id": "317cde49-4630-4a5b-8028-26c33d873ec5",
        "name": "Epsilon Stealer",
        "slug": "epsilon-stealer"
      },
      {
        "id": "39bae314-6dfb-4d13-a499-235c780235b8",
        "name": "SonicGlyde",
        "slug": "sonicglyde"
      },
      {
        "id": "792f8baa-cf48-4777-ae79-473b6689aaf1",
        "name": "Nikki Stealer",
        "slug": "nikki-stealer"
      },
      {
        "id": "c02c8f6e-9fcc-405b-9564-a4d660130312",
        "name": "Iluria Stealer",
        "slug": "iluria-stealer"
      }
    ],
    "intrusion_sets": [
      {
        "id": "94f8946c-06cf-4b03-b3bf-ad4dfa9008e9",
        "name": "Ykg, Noxty, Outlier, Ness",
        "slug": "ykg-noxty-outlier-ness"
      }
    ],
    "attack_patterns": [
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "5bab4974-1fc2-4144-b093-28ebcb8767dc",
        "name": "T1114"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.cyfirma.com/research/iluria-stealer-a-variant-of-another-discord-stealer",
    "https://otx.alienvault.com/pulse/6650519728f9ed0c30ce7501"
  ]
}