UnixStealer (a310Logger) — Discord Webhook Veri Sizdirma, Telegram Bot C2, brtig PDB Gelistirici Izi | Kritik

Manuel Statik Analiz (LLM Okumali) — UnixStealer (a310Logger) | Tehdit: KRITIK

Fichier Kimligi

SHA256	`0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4`
MB Etiketi	BlackGuard / a310Logger (MB)
Gercek Adi	UnixStealer (PDB'den)
Taille	303.617 byte
Platform	.NET (C#)

Cleartext Discord Webhook C2 (KRITIK)

Discord Webhook (Exfiltrasyon):
https://discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f

Telegram Bot API (C2 Bildirim):
https://api.telegram.org/bot[TOKEN]

VimeWorld Dead Drop:
https://api.vimeworld.ru/user/name/

UYARI: Discord webhook ve Telegram Bot API adresleri cleartext string olarak PE icinde tespit edilmistir. Bu adresler araciligiyla calinti veri dogrudan saldirganin Discord kanaline ve Telegram botuna iletilmektedir.

Gelistirici Izi (PDB Sizdirmasi)

C:\Users\brtig\OneDrive\Desktop\Src\UnixStealer\UnixStealer\obj\Release\UnixStealer.pdb
Developer kullanici adi: brtig
Proje adi: UnixStealer
IDE: Visual Studio (Release Build)

Stealer Modulleri

Modul	Hedef
UnixStealer.Chromium	Chrome, Brave, Edge — sifre/cookie/kredi karti
UnixStealer.Edge	Microsoft Edge veritabani
GrabTelegram	Telegram Desktop session
GetLocationSteam	Steam ssfn + hesap bilgisi
BitcoinCore	Bitcoin Core wallet.dat
WriteDiscord	Discord webhook exfiltrasyon modulu

IOC

SHA256	`0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4`
Discord Webhook	`https://discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f`
C2	api.telegram.org (bot), api.vimeworld.ru (dead drop)
Developer	brtig (OneDrive/Desktop)

UnixStealer — Profil du malware

UnixStealer (MB: a310Logger olarak etiketli), Discord webhook ve Telegram Bot API ile veri sızdiran .NET infostealerdir. Hedefler: Chrome/Edge/Brave sifreleri, Telegram Desktop session, Steam hesabi, Bitcoin Core wallet.dat. Gelistirici: brtig (PDB sizdirmasi).

Type de malware

Infostealer

Langage de programmation

C#/.NET

Protocole C2

Discord Webhook/Telegram

Systèmes ciblés

Kuresel Bireysel

Capacités et comportement

Tarayıcı Kimlik Bilgileri

Çerez Hırsızlığı

Kripto Cüzdan Çalma

Sistem Bilgisi

Ekran Görüntüsü

FTP/SSH İstemci Şifreleri

E-posta İstemcisi Çalma

Veri Sızıntısı

Liste IOC (1 indicateurs)

IOC — UnixStealer

# SHA256
0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4

Type	Valeur	Note
sha256	0d6f87aa1826205087affc7248276844f30892bd62b3f96ec75d02ceeb8cc5b4

UnixStealer — Voir le profil complet →

Serveurs C2 (3 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
api.vimeworld.ru	domain	443	HTTPS	active	—
api.telegram.org	domain	443	HTTPS	active	—
discord.com/api/webhooks/1447625794359922871/P8qhcUhcDIHUGD1nOnDph6_jiieLZ1Pb53vxaOsrZQ6tHyNyb7SSCwCX0JcaaQZucT3f	domain	—	HTTPS	inactive	—

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.