LOBSHOTMalware
According to PCrisk, LOBSHOT is a type of malware with a feature called hVNC (Hidden Virtual Network Computing) that allows attackers to access a victim's computer without being noticed. The hVNC component is effective in evading fraud detection systems. Also, LOBSHOT is being used to carry out financial crimes through the use of banking trojan and information-stealing functionalities.From MISP Galaxy
Last reported 2 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1176.001Browser Extensions
“After the browser extensions are enumerated, there is a check for a hardcoded file titled hmr_*.dat inside the C:\ProgramData directory.”
- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1036Masquerading
“… derivative of REDLINE, with additional features; our malware analysts recently encountered a sample of METASTEALER within a campaign masquerading as Roblox, previously reported by CERT as Orange Polska.”
What the reports say
2 reports, newest first · the exact sentence from each-
Globally distributed stealers“STEALC also incorporates the Microsoft Defender emulation check, we have observed this in many stealers such as seen in LOBSHOT.”
-
Elastic Security Labs discovers the LOBSHOT malware“Elastic Security Labs discovers the LOBSHOT malware”
Indicators in its reports
named in the reports above- agile[.]netin 1 report
- hxxps://www.amydecke[.]websitein 1 report
- www.amydecke[.]websitein 1 report
- e4ea88887753a936…e27991856bf6in 1 report
- 95.217.125[.]200in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/actor/ta505in 1 report
- hxxps://www.malware-traffic-analysis[.]net/2023/01/23/index.htmlin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.