{
  "name": "The Will of D: A Deep Dive into Divulge Stealer, Dedsec Stealer, and Duck Stealer",
  "slug": "the-will-of-d-a-deep-dive-into-divulge-stealer-dedsec-stealer-and-duck-stealer",
  "description": "This analysis examines three emerging malware threats: Divulge Stealer, DedSec Stealer, and Duck Stealer. These stealers, often promoted on platforms like GitHub and Telegram, target browser data, game information, and sensitive personal details. Divulge Stealer, a successor to Umbral Stealer, features anti-VM capabilities and targets multiple browsers and cryptocurrency wallets. DedSec Stealer, a copy of Doenerium, employs similar evasion techniques and focuses on stealing various types of data. Duck Stealer, identified as AZStealer, shares functionalities with the others, including anti-VM features and extensive cryptocurrency wallet targeting. The analysis highlights the interconnected nature of these threats and their potential impact on users and organizations.",
  "published": "2024-10-21T08:51:18+00:00",
  "created_at": "2024-10-21T08:51:18+00:00",
  "modified_at": "2024-10-21T08:54:02+00:00",
  "created_at_opencti": "2024-10-21T08:51:18+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-21",
    "anti-vm",
    "azstealer",
    "browser data theft",
    "cryptocurrency",
    "dedsec stealer",
    "divulge stealer",
    "doenerium",
    "duck stealer",
    "infostealer",
    "umbral stealer"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "a2b284d185326ef5a6031fd2278302a715181989230b54f9e4e4d79545a0dde7"
      },
      {
        "id": "",
        "name": "5dd0d74ce7e044c93ae79a7d5a66e1a1cd2a8c838c89e19f67279ab91dc19bd9"
      },
      {
        "id": "",
        "name": "051829813ea3c66e37f184bbfaa2fa3d8752abbfa4828fa5847f1986ae461e3c"
      }
    ],
    "malware": [
      {
        "id": "f9c9bc44-89d3-4a81-8a90-df7845397106",
        "name": "AZStealer",
        "slug": "azstealer"
      },
      {
        "id": "7df52918-c057-47d0-a059-783cd3729230",
        "name": "Duck Stealer",
        "slug": "duck-stealer"
      },
      {
        "id": "659d933a-cd5d-4ccb-8efd-43e36be290a9",
        "name": "Umbral Stealer",
        "slug": "umbral-stealer-9da8076c"
      },
      {
        "id": "e9b87e77-0f4b-4a98-b125-9b516ab4a13d",
        "name": "DedSec Stealer",
        "slug": "dedsec-stealer"
      },
      {
        "id": "ba728830-5738-4a66-9558-388e2f09eeb6",
        "name": "Divulge Stealer",
        "slug": "divulge-stealer"
      },
      {
        "id": "6f2f901f-77e7-416a-8718-104c468f4c26",
        "name": "Doenerium",
        "slug": "doenerium"
      }
    ],
    "attack_patterns": [
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.cyfirma.com/research/the-will-of-d-a-deep-dive-into-divulge-stealer-dedsec-stealer-and-duck-stealer/",
    "https://otx.alienvault.com/pulse/671632274cd6fde9de79aec3"
  ]
}