← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
New NodeStealer Variant Targeting Facebook Business Accounts and Crypto Wallets
WHITE BITSecurity 2023-08-02 Modified: 2023-08-02
160
IOCs
HIGH VOLUME
Cybersecurity researchers have unearthed a Python variant of a stealer malware NodeStealer that's equipped to fully take over Facebook business accounts as well as siphon cryptocurrency. The attacks start with messages on Facebook that claim to offer free "professional" budget tracking Microsoft Excel and Google Sheets templates, tricking victims to download a ZIP archive file hosted on Google Drive. The ZIP file is designed to download additional malware such as BitRAT and XWorm in the form of ZIP files, disable Microsoft Defender Antivirus, and carry out crypto theft by using MetaMask credentials from Google Chrome, Cốc Cốc, and Brave web browsers.
nodestealervariantcortex xdrfacebookmetamaskmetaunitpalo altonetworksgraph apibitratallianceaprilpythondefenderpowershellxwormmaincodeducktailphishingpeguishvnctoggledefendervietnamese
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Phishing Peguis hVNC ToggleDefender Vietnamese NodeStealer
Indicators of Compromise (131 / 160 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 001f9d34e694a3d6e301a4e660f2d96bc5d6aa6898f34d441886c6f9160d9e48 — 2023-08-02
FileHash-SHA256 009827ab2624370ded2cb8240ca2fe82af36e3a94cff1f8a2eac574b4b928c4e — 2023-08-02
FileHash-SHA256 0901d9b4ad36a264904bb41b555b32c87790e7861969fa7495da7892aef8f67c — 2023-08-02
FileHash-SHA256 0d313ad0b46218acfc25fae744b53eb539169e56f9976eec47f37d99ebce510c — 2023-08-02
FileHash-SHA256 14000dc5c64ad50e534739afa86ce37c30b04a8aba48feb0f645b0a74b545744 — 2023-08-02
FileHash-SHA256 1998492619c1fc6a5b78d5c4c6beb05c582a1be6ad2b9ac734179c731bbcf5cc — 2023-08-02
FileHash-SHA256 1a06498f31a70b7d3fe043269cc87dcd70528a9303af3fa66933ceaa372006b3 — 2023-08-02
FileHash-SHA256 1a4e8bcf7dc4ad7215957210c8e047f552b45a70daf3d623436940979c38f94c — 2023-08-02
FileHash-SHA256 1ada42adb9ee65aa02d5eb9d24d3455df61c85f69e84f310b9630d62ca83a518 — 2023-08-02
FileHash-SHA256 1cf31091a0e6d9dade4675497593d04815d7ba22b0b018d06358211f3429ab49 — 2023-08-02
FileHash-SHA256 1ebba84f9352bd171f241bc5d0e06af3145a050fd3e063c503d78085aeba2c34 — 2023-08-02
FileHash-SHA256 1ed522e66e9ddcc97ded3e008c014500e3c3e22a1db995199baa52a7dc93845b — 2023-08-02
FileHash-SHA256 1f093f818d2d3bd146c34d10bdb9de0a33931d3586f0bb942f881052a20114f9 — 2023-08-02
FileHash-SHA256 22d57a535c226b514da92d0dcc902f0029414c5f2b1141bc14ac9a057c791414 — 2023-08-02
FileHash-SHA256 2335a5b90cbf40f0bfe6434c7e9b461ab1ed8f470a9c3d5703d430af30cf5371 — 2023-08-02
FileHash-SHA256 242e8e1ff2608f5c9fa80b89b31f605bb9432b15dace2eba961605b245d577d5 — 2023-08-02
FileHash-SHA256 283570b242e8de90f3ad4b9f332c03eefc3c8464981d1ad072cc061f9e29ce97 — 2023-08-02
FileHash-SHA256 2a685317d74f78e8d627791ccf6ffec9e2a8690e4bffacbbffab934b12669ae9 — 2023-08-02
FileHash-SHA256 2cabb8e10c5ad57788d99f5218a1248e0ada9a5bdbd5f976d9523b2e4a47aacf — 2023-08-02
FileHash-SHA256 2e56a8e4002de238bd1b792d495f59edd598cda49d649d42112f951ecb003432 — 2023-08-02
FileHash-SHA256 2fdac894299a2889c36959e34bacd3898029974af1b2f60552534454c54bd976 — 2023-08-02
FileHash-SHA256 3064aa87c463adda7752b84cd18e2e859723a9953e090f7757edf7ce4b96e536 — 2023-08-02
FileHash-SHA256 31038f33d8d757c19050d41e62036a85026bbe99d37fd806fdde7f261fd2651b — 2023-08-02
FileHash-SHA256 3366f47822b72445aa06d2e2c455dd4816e5df2f83e7bd03f21e77b1cb2b8948 — 2023-08-02
FileHash-SHA256 34353c1734066cd11b1c002f770834d392aa225434e1bc8b4ec65ef753241e23 — 2023-08-02
FileHash-SHA256 346d51b00a14087bcd63f063e4a3f572f49b1c41a5c60fa03095aac42837a7ce — 2023-08-02
FileHash-SHA256 38cbccea7c9f3032a8348e54bb94871b26279a7cca64f5b79c3fa54c240960d2 — 2023-08-02
FileHash-SHA256 3984a025b7fb7c5ada86da0b4fa32bef88eb2a01fb337a7f73619cb716c859ab — 2023-08-02
FileHash-SHA256 3ab41e160854a686baf56e5032b933778663c37e03d148d3bf669a6c3228f6da — 2023-08-02
FileHash-SHA256 3fff146c3e50a7ddc7e446ae51742c59c3d3277931f3c511d9651497e4ab14a7 — 2023-08-02
FileHash-SHA256 415d70be7a2e3ae8fd2babc929c3110fce7ce66d23ec32c473c6aab73c5c00f8 — 2023-08-02
FileHash-SHA256 41a09e66c24953c7cb19f4a09b0779c8e9bcb39f0e544d0bdc9760c9b3d56e03 — 2023-08-02
FileHash-SHA256 4316a560734e68303860899d0f2b07a9ef4618647da2e8ad38bab70a4e532f88 — 2023-08-02
FileHash-SHA256 43dd5f8d2a5bea2751bf8d02920038e93df6ba3b8f5c0b1193fa70cac1e9b9a2 — 2023-08-02
FileHash-SHA256 440541d9e9c4d1fa8a1f33ce8c434ace11786e278278df7a600978290b33e93f — 2023-08-02
FileHash-SHA256 44dabadbf099bdb28fdc4d86cebe53c00085c9c2ad52df4d4774320409e7358b — 2023-08-02
FileHash-SHA256 45a6c41111677c6374899475aa253f713a08158ce9b5dbd7566e15eda1e61a0a — 2023-08-02
FileHash-SHA256 466158cf86c8f14d125d661f75fe0c4c2410e2896eaabd90b1d28137b7df81b3 — 2023-08-02
FileHash-SHA256 4932514acfad25c7b2a1631706aef8d91a415315e5207e1bc9a24791298e6319 — 2023-08-02
FileHash-SHA256 4f91fdf024b54ad650c13f7ffe1a7f3eb6cad66eb457e8a7fe494cf9bdb6f42a — 2023-08-02
FileHash-SHA256 5049de4c58ea923723389e4d732f1c134dc38582971f4872593e1153db945078 — 2023-08-02
FileHash-SHA256 50b5ab35c1e78429fdcdd45e2a0ceacc140fbf4022f7c34bac4b5f296a17379a — 2023-08-02
FileHash-SHA256 565bc8725a1ae03e534f66ad8995854d24ba3893fe37c8e3e13c58874129849b — 2023-08-02
FileHash-SHA256 57c234dc3a210467b990c16092fbd3af2dc0aaf8aabbdfa1b566138b2abc5e82 — 2023-08-02
FileHash-SHA256 61237de2472bbf39086a18d462fd5fd9649292d17fe630f1dd550159e26d711e — 2023-08-02
FileHash-SHA256 65669e873a3732f1617c9c80667a1c3efda5f72538b5abd475e80a25efc0e5e2 — 2023-08-02
FileHash-SHA256 65db46d1f48c9c15fe97147ee918fae626225c5603293b72da8e484a9c91123f — 2023-08-02
FileHash-SHA256 6660776dfecf917cfbd51a0fa853052005f3d4a136c1edce0a3d6b7002c3f48e — 2023-08-02
FileHash-SHA256 6777bbf5fd14eb1a7e81de33c477ac5ba4f446699df447995e8d362a8438a0a3 — 2023-08-02
FileHash-SHA256 6d12c657ee403272cb3115fd0a6cf1ffe69cd4476c5a03bbc13c624ddd153518 — 2023-08-02
FileHash-SHA256 7072dbc19da9713c997cdbcacbc68ca709e900d44bb3572bc34fb3c91ecbea9f — 2023-08-02
FileHash-SHA256 77459352c074012c1e0d010e2b8792d08f36ca6f7bf4882b2db2af4aa1944e5f — 2023-08-02
FileHash-SHA256 774bb5ed2bcb6ebd9cbd6b53e4dc1a352df58dfda17ef11da9c8ffa4d4851681 — 2023-08-02
FileHash-SHA256 7aa48f6531c6d6dd7b60a4c6d10cacc69bdee98034b25379a04a8e308dece36f — 2023-08-02
FileHash-SHA256 7bf3d295fc8d2605528331c0da32d83f2b98489884bd92a24b71425fa13290db — 2023-08-02
FileHash-SHA256 7c59713b5ae4dd41c94cda9c2cb15a2e6173b886157a2ba5a68842cc7bdde698 — 2023-08-02
FileHash-SHA256 825379e514d1a0383120735c4c19530a3d4130d5e77ff51b7bb2eb3b6ca1d704 — 2023-08-02
FileHash-SHA256 834215c7226d28be513562991cacd7f56f4914b8ae1e27ff3ae85ca82e208605 — 2023-08-02
FileHash-SHA256 843028f3054707843ebc650a01b1ded0414d6933525cb056cf5a66a49afe3022 — 2023-08-02
FileHash-SHA256 8582241f8e0163f6360486e9b59e54c91dd3219538e03619e9e999f90aa92f81 — 2023-08-02
FileHash-SHA256 86424c0a908fc3d651d86bc7c3d87ce38ef626516f48a160e2cfcf2630a1e9b8 — 2023-08-02
FileHash-SHA256 8896c07441ce8799660c1d94d64231a41735bac10a2e984838bc21a2682c9c99 — 2023-08-02
FileHash-SHA256 91b975e87d8d6469683168a48ca0bc11a333e3f5692f224d33f2008573173cc6 — 2023-08-02
FileHash-SHA256 92657c3a108bbedc6f05b4af0a174e99a58e51e69c15c707d9c9cc63cdf1b4ea — 2023-08-02
FileHash-SHA256 9274f0391add4a1ac7c90942628a9fd80a9fca3d11aabb74b4e385eee4f66354 — 2023-08-02
FileHash-SHA256 9282f4b1fa8ecf1273ddf3291abcc8fc073b2e99a00f70985077197112a46c4c — 2023-08-02
FileHash-SHA256 92eba1a137918f99fbe15651568b8b76ad5f59788b1bce9076bfb33bbc3484de — 2023-08-02
FileHash-SHA256 989f62528b32d47e50f1bd61cc7dc2e9cb25f54514374902d8a9ce41fcfcd779 — 2023-08-02
FileHash-SHA256 9a551426cbb2cd7aded923f277eec195a282913d51c41f1791683e03a85379e0 — 2023-08-02
FileHash-SHA256 9a6eae518100361b3e3fd4f34877623af5544e2b95cdf29a7e9e2d91e4baa271 — 2023-08-02
FileHash-SHA256 9b1dcde16f34ac3d5abc15510060cd1692591054988416167dae3c4643e5796c — 2023-08-02
FileHash-SHA256 9d3ccd754f7e0b891fcad461df92746f52abcf727082750e3aefade7531f162e — 2023-08-02
FileHash-SHA256 9dba2cef0e28a24b59eda107633528cd83257f033a5d4330cf3302943b3e07c2 — 2023-08-02
FileHash-SHA256 9ecba5aa60b9c202b1c69aade1edabb1c04072471a3618a5d714aa8833d570f4 — 2023-08-02
FileHash-SHA256 9f85de94a15c5c93a88375d9aacb9f9e111cedec611ee4f2b58a53727db92a88 — 2023-08-02
FileHash-SHA256 9fe91d63d63f7667c1879f7ea3e31b9d6dacc2d3216df2b47392bb1dff741f89 — 2023-08-02
FileHash-SHA256 a03f37bb04dbd0f602ad8f5e52e87650ecf8fc57763c043de436996ce222e81d — 2023-08-02
FileHash-SHA256 a41b170f554a752a23769b28f3fa93703fa160b74897a8f35078d1e8923b91b0 — 2023-08-02
FileHash-SHA256 a45ff2f03d88abfb949b8c8f40fa08fa7e72d22e756716f8dc18e2f34376b722 — 2023-08-02
FileHash-SHA256 a62acb65022abbd849e0a741a17485156333fbfe26f32c50654b3818335c1d0d — 2023-08-02
FileHash-SHA256 a6509563be7a8569e05198858658b8934d7bc5ad3d41e9806e261995c99a6acf — 2023-08-02
FileHash-SHA256 a8608b8537338659943802bd4c3f37465b6b7146c60088e890f1201452690510 — 2023-08-02
FileHash-SHA256 a8adea800186dd52173dc6e55c46aa0b3619bef3eee25b17b7edba9353d5d08e — 2023-08-02
FileHash-SHA256 a9aae05b05f42bd3d1f9d7894a68db976977573741ddcdf6f388b7d685765564 — 2023-08-02
FileHash-SHA256 b07091d52014cf11c58f07f676eb150db006d9f9274ce6888d5aa8d7a6e4f793 — 2023-08-02
FileHash-SHA256 b2d44e572933ff26977e25a254c0ce705939fac9f422871fd22a875323487bcf — 2023-08-02
FileHash-SHA256 b78a980b66327c4e45f95f2e0fc2dbaffebcac00107cd16ac2d2c2a42618e645 — 2023-08-02
FileHash-SHA256 b87ead56ff364a052619c373b8c06d2150561196f87e584590f67a341ba78abc — 2023-08-02
FileHash-SHA256 bb500217f8940a3491cb69a26d10b5753e3ef1fab59909d88a12dba44344df1e — 2023-08-02
FileHash-SHA256 bb8a127d9f8eb5c598617682a4ab29ee023ae8f40428c6076b0b493116eca8bb — 2023-08-02
FileHash-SHA256 bd14e501b49bb332fd102f65558be47e762ff8885d9c7dfe6c152597603664f1 — 2023-08-02
FileHash-SHA256 bd16e9d3f730df6b88fff91485d3d27e544f3bb819347b0886806b1c14cbd575 — 2023-08-02
FileHash-SHA256 bf3b35d225b2ec555ad06eb1dd0af464bb48596bebb0b2543eaf9e060f0fb1b9 — 2023-08-02
FileHash-SHA256 bf71b31e2612441e28df35f7e4ae56616ded9c6802758b010007b49e05876011 — 2023-08-02
FileHash-SHA256 bfb4f44e8dd9c0a708df89f0f114b523c446baaee19205d62ad99bb53a8b5935 — 2023-08-02
FileHash-SHA256 c150086d14539040556c3c91c93c31395d23ee7bc348bd3dc1d0afa0ff9365bb — 2023-08-02
FileHash-SHA256 c272d218f34bc65e6753e7ece1fe6e56799782678a66a5084e71bbb8690fe724 — 2023-08-02
FileHash-SHA256 c37ee014b97eddbd9060e6bc3a27ec5de2c37a03c45f3a50fd9420a847145a20 — 2023-08-02
FileHash-SHA256 c8d4f567e2162fce6b49c15ca0908f9e3171e6bb6acbfd2c7b129872053b025d — 2023-08-02
FileHash-SHA256 c8fee685d506575138c8b02f118323ca586f62a6e80edf1d726fd555a1c386ba — 2023-08-02
FileHash-SHA256 cc03f53a7a85d9b1b28a6422556b295cb9b00e93b5afc96559140f32f96305e9 — 2023-08-02
FileHash-SHA256 cd06ab37c8e4d6e4264f2ac0949ab7694eb5cc11925853a50c33b13b012eca6f — 2023-08-02
FileHash-SHA256 cdcaf4ecae94421503364d28ef72eb65a83f300980cd1a8ba02bea1c29e193ec — 2023-08-02
FileHash-SHA256 ce6314bfe207e4106df4249452b654ffa892a1bd45bc7ff9d6871b1dbe8e3e3b — 2023-08-02
FileHash-SHA256 cfb50c7fe40334c1f52759a08289e36be0ada9056e3dcb22898efd8187b6464d — 2023-08-02
FileHash-SHA256 d117bdaeee8d1f3cca5c685930f19754b82ffbd6de8f2a6dc1895fee1a00e220 — 2023-08-02
FileHash-SHA256 d12196087135b9383a4e9820d27625c059511c4776593a4d2eb83409a96af3a5 — 2023-08-02
FileHash-SHA256 d3e1060a003f6a8073dea4f6c976f552372cd4ab9251953c0932be22c6f6605f — 2023-08-02
FileHash-SHA256 d4f8813b0aba21d6021719d022fcc6feab5cdd6e2a999dfe178347a394abfb84 — 2023-08-02
FileHash-SHA256 d9524819eeb3ef9268d526703af8a7921a5d98429341834eb84f04b9edb34b64 — 2023-08-02
FileHash-SHA256 dccc95c28bbc1f049c06e7b3a9866a920c4c4081e3176b26fc6aea2cb59daed7 — 2023-08-02
FileHash-SHA256 e5026d9327dd19c8749ef1d93ebfbd7c1d3c3e1055bb2c1efc7ed261d7dd16de — 2023-08-02
FileHash-SHA256 e856cc78ce1603547bb6fdb3eb9da137f671e9547c072abea63b0248ec82ecb1 — 2023-08-02
FileHash-SHA256 e90f31c41a64ce85abfa284126e63b693088934fd83ef8fea13724810f394efa — 2023-08-02
FileHash-SHA256 ea96973f3d71cccad26bce7f106f5800fcb007cf33d82fa00f5d564994397153 — 2023-08-02
FileHash-SHA256 eac6574eb3b1a6bf9818136875378ee2362901092b61d221541977925076edf3 — 2023-08-02
FileHash-SHA256 f08394c78f40c3028156c78672d1a8030c64a9f292b1fbb4bd42437381c96a54 — 2023-08-02
FileHash-SHA256 f2548fd9d622dae1b21e18323a2d8dca2f7670789dfbb5f6d32320f4fd289039 — 2023-08-02
FileHash-SHA256 f31e2c430d4a8b17b45591bf68e5c4c7f7c28e4ccbd4cabcd10c33ba14b388c3 — 2023-08-02
FileHash-SHA256 f4b6a051789ba7b245db69a3b56dee1404b3f9eff9c7e7c80c54328bedcc44e9 — 2023-08-02
FileHash-SHA256 f51880293a2bd24da4182965ad5c9b4936eab23a20ed0b4264b75d6c3a3eeac5 — 2023-08-02
FileHash-SHA256 f61403729e3f4e212411db486a537eabca2d0b84be21b789cddca4fc3aa85923 — 2023-08-02
FileHash-SHA256 f66434337a25804da491d45a7108eab49ad0de1b2b26f41650ae9567ec45a02a — 2023-08-02
FileHash-SHA256 f80700c220246238507cf5eedcb2e1397c32b3646bb90ad990e7fb69199752b5 — 2023-08-02
FileHash-SHA256 fa5b9b72f248e1f79b3a424b61a1bcce8bf6a99452545cfe15d7211f3eb3e93b — 2023-08-02
FileHash-SHA256 fab5abe774e1af199da4b85df87077e2e8f66c6f00f083b9074fd2186e455bfb — 2023-08-02
FileHash-SHA256 fd47754e9476d5d5969cd1c2db1a4d3203ab50e4b92e31bc7cc02945b8d2857e — 2023-08-02
FileHash-SHA256 fddb2fc6c63d33500f3ef0d8c3fe212abe21044820a2524379904131e7f11765 — 2023-08-02
FileHash-SHA256 fe1608dbfa620231ee9649a4687ac03c2acfbcec9b7ab49da06e182209c31eb5 — 2023-08-02
FileHash-SHA256 fe434fff6becc2d829bbfed6ba9bf88154028d0327e7c6aa870ad050235fc334 — 2023-08-02
FileHash-SHA256 fed5ea7840461984fa40784d84ed1a0961cbf48b03d8b79c522286bf6e220922 — 2023-08-02
References (1)
↗ https://unit42.paloaltonetworks.com/nodestealer-2-targets-facebook-business/