ScreenCapMalware
SentinelOne describes this malware as capable of doing screen capture and keylogging. It is uses by a threat cluster they named WIP19, targeting telecommunications and IT service providers in the Middle East and Asia.From MISP Galaxy
Last reported 2 months ago, by Huntress1 report
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“T1036”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1056Input Capture
“Input Capture: GUI Input Capture (fake recovery form)”
- T1056.002GUI Input Capture
“T1056.002”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Reverse Engineering the Six Stages of MacSync Stealer and RAT“It's an 84KB Objective-C Mach-O called ScreenCap inside a minimal .app, and its Info.plist is the first tell:”
Indicators in its reports
named in the reports above- com[.]applein 1 report
- 85.206.161[.]241in 1 report
- malwareaudit[.]comin 1 report
- 103.216.221[.]95in 1 report
- hxxp://agenticsora[.]com/curl/in 1 report
- agenticsora[.]comin 1 report
- hxxp://agenticsora[.]com/dynamic?txd=in 1 report
- hxxps://agenticsora[.]com/loader/agent/in 1 report
- capture[.]appin 1 report
- wallet[.]appin 1 report
- hxxps://main.sdhomeinspectors[.]com/modules/walletsin 1 report
- main.sdhomeinspectors[.]comin 1 report
- sldev[.]czin 1 report
- invity[.]ioin 1 report
- main.southcarolinacounselor[.]comin 1 report
- sdhomeinspectors[.]comin 1 report
- southcarolinacounselor[.]comin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.