UnixStealer (a310Logger) — Discord Webhook Veri Sizdirma, Telegram Bot C2, brtig PDB Gelistirici Izi | Kritik

Manuel Statik Analiz (LLM Okumali) — UnixStealer (a310Logger) | Tehdit: KRITIK

文件 Kimligi

SHA256	`0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4`
MB Etiketi	BlackGuard / a310Logger (MB)
Gercek Adi	UnixStealer (PDB'den)
大小	303.617 byte
Platform	.NET (C#)

Cleartext Discord Webhook C2 (KRITIK)

Discord Webhook (Exfiltrasyon):
https://discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f

Telegram Bot API (C2 Bildirim):
https://api.telegram.org/bot[TOKEN]

VimeWorld Dead Drop:
https://api.vimeworld.ru/user/name/

UYARI: Discord webhook ve Telegram Bot API adresleri cleartext string olarak PE icinde tespit edilmistir. Bu adresler araciligiyla calinti veri dogrudan saldirganin Discord kanaline ve Telegram botuna iletilmektedir.

Gelistirici Izi (PDB Sizdirmasi)

C:\Users\brtig\OneDrive\Desktop\Src\UnixStealer\UnixStealer\obj\Release\UnixStealer.pdb
Developer kullanici adi: brtig
Proje adi: UnixStealer
IDE: Visual Studio (Release Build)

Stealer Modulleri

Modul	Hedef
UnixStealer.Chromium	Chrome, Brave, Edge — sifre/cookie/kredi karti
UnixStealer.Edge	Microsoft Edge veritabani
GrabTelegram	Telegram Desktop session
GetLocationSteam	Steam ssfn + hesap bilgisi
BitcoinCore	Bitcoin Core wallet.dat
WriteDiscord	Discord webhook exfiltrasyon modulu

IOC

SHA256	`0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4`
Discord Webhook	`https://discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f`
C2	api.telegram.org (bot), api.vimeworld.ru (dead drop)
Developer	brtig (OneDrive/Desktop)

UnixStealer — 恶意软件档案

UnixStealer (MB: a310Logger olarak etiketli), Discord webhook ve Telegram Bot API ile veri sızdiran .NET infostealerdir. Hedefler: Chrome/Edge/Brave sifreleri, Telegram Desktop session, Steam hesabi, Bitcoin Core wallet.dat. Gelistirici: brtig (PDB sizdirmasi).

恶意软件类型

Infostealer

编程语言

C#/.NET

C2协议

Discord Webhook/Telegram

目标系统

Kuresel Bireysel

能力与行为

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

IOC列表 (1 个指标)

IOC — UnixStealer

# SHA256
0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4

类型	值	备注
sha256	0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4

UnixStealer — 查看完整档案 →

C2服务器 (该家族共有 3 台已记录服务器)

地址	类型	端口	协议	状态	国家
api.vimeworld.ru	domain	443	HTTPS	active	—
api.telegram.org	domain	443	HTTPS	active	—
discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f	domain	—	HTTPS	inactive	—

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签

unixstealera310loggerdiscord-webhooktelegram-c2discord-exfilsteamkriptopdb-leakedbrtig