SYMBOLCOMMON_NAMEaka. SYNONYMS
win.stealer_0x3401 (Back to overview)

Stealer0x3401

Actor(s): APT31

According to PTSecurity, this stealer harvests system information which is then RC4 encrypted and Base64 encoded before sending it to the C2 server.

References
2022-08-04 ⋅ PTSecurity ⋅ PT ESC Threat Intelligence
@online{intelligence:20220804:flying:99dfe7f, author = {PT ESC Threat Intelligence}, title = {{Flying in the clouds: APT31 renews its attacks on Russian companies through cloud storage}}, date = {2022-08-04}, organization = {PTSecurity}, url = {https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/apt31-cloud-attacks}, language = {English}, urldate = {2022-08-09} } Flying in the clouds: APT31 renews its attacks on Russian companies through cloud storage
Stealer0x3401 YaRAT
2022-08-04 ⋅ PTSecurity ⋅ PT Expert Security Center
@online{center:20220804:flying:a16b831, author = {PT Expert Security Center}, title = {{Flying in the clouds: APT31 renews its attacks on Russian companies through cloud storage}}, date = {2022-08-04}, organization = {PTSecurity}, url = {https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/apt31-cloud-attacks/}, language = {English}, urldate = {2022-08-15} } Flying in the clouds: APT31 renews its attacks on Russian companies through cloud storage
Stealer0x3401 YaRAT

There is no Yara-Signature yet.