CageyChameleonMalware
- cabbage rat
CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.From MISP Galaxy
Last reported 16 months ago, by Huntress1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1027.009Embedded Payloads
“There are two main things this binary does: in the first, it takes another binary and a password as arguments and will decrypt embedded payloads.”
- T1055Process Injection
“This occurs for both base64 blobs which are later used in the process injection portion.”
- T1056.001Keylogging
“It will start running the keylogging binary and one of the binaries contained in the .version file:”
- T1176.001Browser Extensions
“As is typical with stealers to do this, they iterate over installed browser extensions looking for wallet plugins.”
- T1552.003Shell History
“Lastly, it removes the shell history, so users are unaware of what ran.”
- T1684Social Engineering
“Identifying and mitigating Meeting application social engineering”
What the reports say
1 report, newest first · the exact sentence from each-
Inside the BlueNoroff Web3 macOS Intrusion Analysis“…onducted by the North Korean (DPRK) APT subgroup tracked as TA444 aka BlueNoroff, Sapphire Sleet, COPERNICIUM, STARDUST CHOLLIMA, or CageyChameleon—a state-sponsored threat actor known for targeting cryptocurrencies stemming back to at least 2017.”
Indicators in its reports
named in the reports above- support.us05web-zoom[.]bizin 1 report
- 3dd226d0b700f339…750eb1702e2ain 1 report
- c4db903322d17c8c…06df24c572dfin 1 report
- firstfromsep[.]onlinein 1 report
- hxxps://metamask.awaitingfor[.]site/updatein 1 report
- metamask.awaitingfor[.]sitein 1 report
- productnews[.]onlinein 1 report
- 4cd5df82e1d4f933…497fb5cb438cin 1 report
- ad01beb19f5b8c71…d9f737f2d320in 1 report
- ad21af758af28b76…11c2e18f42ffin 1 report
- 432c720a9ada4078…ee0a451bb249in 1 report
- 1ddef717bf82e61b…0c036da5ce05in 1 report
- 14e9bb6df4906691…afad41fa1527in 1 report
- 2e30c9e3f0324011…cb89392af23din 1 report
- 469fd8a280e89a6e…7006b573865fin 1 report
- 080a52b99d997e1a…9d47a71122afin 1 report
- safeupload[.]onlinein 1 report
- safefor[.]xyzin 1 report
- readysafe[.]xyzin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.