DeerStealerMalware
According to Broadcom, DeerStealer is an information stealer written in Delphi and targeting devices running an windows operating system. The malware has hidden VNC capabilities for stealthy remote desktop control, collecting crypto wallets from USB sticks and over 800 browser extensions. It exfiltrates the stolen data in form of a ZIP archive to a botnet C2 server.From MISP Galaxy
Last reported 4 months ago, by Red Canary1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The dual-use dilemma: Rethinking detection for remote access tool abuse“…ble.exe and establishing persistence, researchers detected it sideload malicious DLLs before ultimately downloading and executing the DeerStealer infostealer and HijackLoader.”
Indicators in its reports
named in the reports above- remotedesktop[.]comin 1 report
- syncroapi[.]comin 1 report
- kabutoservices[.]comin 1 report
- hxxps://server.rarexterna[.]top/Bin/ScreenConnect.ClientSetup.msiin 1 report
- server.rarexterna[.]topin 1 report
- pdq[.]comin 1 report
- lolrmm[.]ioin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.