Koi StealerMalware
Last reported 5 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 20 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
- T1053.005Scheduled Task
“Structured step numbering in operational logs: [STEP 1] Staged mode — payload downloaded from C2 at runtime, [STEP 1/3] Scheduled Task (DotNetSvcUpdateTask, logon + every 3 min), [STEP 2/3] Boot Task (DotNetSvcCoreTask, INTERACTIVE_TOKEN + BootTrigger), [UNINSTALL 4/6] Removing p…”
- T1055Process Injection
“This post analyzes the final stage: PHANTOMPULSE, an implant that ships three process-injection techniques, resolves its C2 through Ethereum/Base/Optimism transaction inputs, and bypasses UAC via the public schuac technique.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT“…p crypto-wallet enumeration set (ledger, trezor, bitcoin-core, electrum, exodus, atomic, guarda) closely matches Unit 42's RustDoor / Koi Stealer for macOS targeting list, which is DPRK-attributed.”
Indicators in its reports
named in the reports above- eth.blockscout[.]comin 1 report
- base.blockscout[.]comin 1 report
- optimism.blockscout[.]comin 1 report
- hxxps://panel.fefea22134[.]netin 1 report
- panel.fefea22134[.]netin 1 report
- ipif[.]orgin 1 report
- checkip.amazonaws[.]comin 1 report
- 0x666[.]infoin 1 report
- 33dacf9f854f6362…b868b11ee70fin 1 report
- 70bbb38b70fd836d…3de4ce327980in 1 report
- def66275fa3baffb…05d121f13c70in 1 report
- fea22134[.]netin 1 report
- 195.3.222[.]251in 1 report
- thoroughly-publisher-troy-clara.trycloudflare[.]comin 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.