BeaverTail (Javascript)Malware
BeaverTail is a JavaScript malware primarily distributed through NPM packages. It is designed for information theft and to load further stages of malware, specifically a multi-stage Python-based backdoor known as InvisibleFerret. BeaverTail targets cryptocurrency wallets and credit card information stored in the victim's web browsers. Its code is heavily obfuscated to evade detection.From MISP Galaxy
Last reported 2 years ago, by Group-IB1 report
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1033System Owner/User Discovery
“T1033: System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“T1041: Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“We presume that the additional payload or new updates to the code will involve installing AnyDesk, and creating a scheduled task for it.”
- T1056Input Capture
“T1056.001: Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001: Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“T1059.006: Command and Scripting Interpreter: Python”
What the reports say
1 report, newest first · the exact sentence from each-
APT Lazarus: Eager Crypto Beavers, Video calls and Games“Updates were also made to BeaverTail (Javascript) and InvisibleFerret as well.”
Indicators in its reports
named in the reports above- hxxp://www.apple[.]com/DTDs/PropertyList-1.0.dtdin 1 report
- ad.anynet[.]idin 1 report
- 1bbb953890e752a6…2dda0bd89e14in 1 report
- 675928d7a0a28f70740b7eedf021de82in 1 report
- 2c5e45a85a8eed94ffed26a7c3b0790ein 1 report
- hxxp://23.106.253[.]194:1244in 1 report
- 23.106.253[.]194in 1 report
- hxxp://45.140.147[.]208:54321in 1 report
- 45.140.147[.]208in 1 report
- hxxp://95.164.17[.]24:1224in 1 report
- 95.164.17[.]24in 1 report
- hxxp://185.235.241[.]208:1224in 1 report
- 185.235.241[.]208in 1 report
- hxxp://freeconference[.]ioin 1 report
- freeconference[.]ioin 1 report
- hxxp://mirotalk[.]netin 1 report
- mirotalk[.]netin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.