Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Unpacking KiwiStealer: Diving into BITTER APT’s Malware for File Exfiltration
Malware Families
Excerpt
KiwiStealer is a file stealer that was first identified in 2024. The first report on the malware was posted on the platform ctfiot . Subsequent reporting from ThreatRay revealed that the malware was observed being used by the threat group Bitter APT in late 2024. The malware collects some system information before attempting to collect files from specific directories. This blog outlines the malware’s capabilities and how it exfiltrates data via HTTP POST requests. This…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 01ffdb013b7f6d96ca03b4270841e76bd06a86f2 | Medium | Score 53/100 | First seen |
| SHA256 | 13d128038c341e850b55bc900ecee93496521c74bd9f3f8ea63e86042c5b6a9b | Medium | Score 53/100 | First seen |
| SHA256 | 4b62fc86273cdc424125a34d6142162000ab8b97190bf6af428d3599e4f4c175 | Medium | Score 53/100 | First seen |
| MD5 | fd5f2cf4b8df27f27dc2e6bddc1a7b2e | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…