{ "type": "Domain", "indicator": "nailproxy.space", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/nailproxy.space", "alexa": "http://www.alexa.com/siteinfo/nailproxy.space", "indicator": "nailproxy.space", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4344001888, "indicator": "nailproxy.space", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69fbad82234fc33123b0ce6d", "name": "EbeeMay2026 Pt1", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-06T21:07:14.769000", "created": "2026-05-06T21:07:14.769000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "filepath", "localappdata", "cve20250994 cve", "temp", "mutex", "local" ], "references": [ "IOCs-May1.csv" ], "public": 1, "adversary": "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 80, "CIDR": 3, "CVE": 10, "FileHash-MD5": 154, "FileHash-SHA1": 140, "FileHash-SHA256": 219, "URL": 80, "domain": 82, "email": 8, "hostname": 60 }, "indicator_count": 836, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "24 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f9ab354863232e7c0dcad1", "name": "nailproxy.space \u2014 GitHub typosquats delivering StealC v2 via custom loader", "description": "March 2026: 19 typosquat GitHub repos impersonating popular OSS (incl. UNICORN Binance WebSocket API).\n\n3-stage chain:\n1. Python utils/ dropper \u2014 4 of 5 modules byte-identical across all 19; compat.py polymorphic 2154 B.\n2. Custom delivery loader ~11 MB PE (MSVC 2019, FNV+ChaCha+embedded VM, Rich-Header). Masquerades as sysconf.exe, drops to %TEMP%, self-deletes after 180 s. Rhadamanthys-style, no YARA match.\n3. StealC v2 stealer DLL msedgeview.dll \u2014 confirmed via MurmurHash3+Chaskey (capa) + Chrome ABE bypass.\n\nDelivery C2: api.nailproxy.space (Cloudflare-fronted). Real exfil: 62.60.226.113:6673 (DE/AS214351, known StealC C2) + spellmarketplace.club. URL pattern /<24-char>/[h|g|u].\n\nLoader and stealer have distinct authors. Operator likely rents StealC v2. Sibling Stage-2 (155dc737...) shares exfil infra via unknown delivery. 17 of 19 typosquats listed in indicators; full count = 19. Full write-up: see Reference.", "modified": "2026-05-05T08:32:48.235000", "created": "2026-05-05T08:32:48.235000", "tags": [ "typosquatting", "supply-chain", "github", "stealc", "stealc-v2", "malware-as-a-service", "python-dropper", "windows-stealer", "crypto-stealer", "chrome-abe-bypass", "nailproxy", "unicorn-binance-suite", "ubwa" ], "references": [ "https://blog.technopathy.club/nailproxy-space-github-malware-campaign" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "StealC", "display_name": "StealC", "target": null }, { "id": "StealC v2", "display_name": "StealC v2", "target": null } ], "attack_ids": [ { "id": "T1195", "name": "Supply Chain Compromise", "display_name": "T1195 - Supply Chain Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [ "Finance", "Software", "Cryptocurrency" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "oliver-zehentleitner", "id": "402971", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_402971/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 11, "FileHash-MD5": 1, "FileHash-IMPHASH": 2, "domain": 2, "hostname": 1, "URL": 19, "IPv4": 1, "FilePath": 3, "Mutex": 1 }, "indicator_count": 41, "is_author": false, "is_subscribing": null, "subscriber_count": 1, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://blog.technopathy.club/nailproxy-space-github-malware-campaign", "IOCs-May1.csv" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT" ], "malware_families": [ "Stealc", "Stealc v2" ], "industries": [ "Finance", "Software", "Cryptocurrency" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "69fbad82234fc33123b0ce6d", "name": "EbeeMay2026 Pt1", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-06T21:07:14.769000", "created": "2026-05-06T21:07:14.769000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "filepath", "localappdata", "cve20250994 cve", "temp", "mutex", "local" ], "references": [ "IOCs-May1.csv" ], "public": 1, "adversary": "Trigona, PowerCod RAT, APT34, PhantomRaven, Hacked sites deliver infostealer, CloudZ RAT", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 80, "CIDR": 3, "CVE": 10, "FileHash-MD5": 154, "FileHash-SHA1": 140, "FileHash-SHA256": 219, "URL": 80, "domain": 82, "email": 8, "hostname": 60 }, "indicator_count": 836, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "24 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f9ab354863232e7c0dcad1", "name": "nailproxy.space \u2014 GitHub typosquats delivering StealC v2 via custom loader", "description": "March 2026: 19 typosquat GitHub repos impersonating popular OSS (incl. UNICORN Binance WebSocket API).\n\n3-stage chain:\n1. Python utils/ dropper \u2014 4 of 5 modules byte-identical across all 19; compat.py polymorphic 2154 B.\n2. Custom delivery loader ~11 MB PE (MSVC 2019, FNV+ChaCha+embedded VM, Rich-Header). Masquerades as sysconf.exe, drops to %TEMP%, self-deletes after 180 s. Rhadamanthys-style, no YARA match.\n3. StealC v2 stealer DLL msedgeview.dll \u2014 confirmed via MurmurHash3+Chaskey (capa) + Chrome ABE bypass.\n\nDelivery C2: api.nailproxy.space (Cloudflare-fronted). Real exfil: 62.60.226.113:6673 (DE/AS214351, known StealC C2) + spellmarketplace.club. URL pattern /<24-char>/[h|g|u].\n\nLoader and stealer have distinct authors. Operator likely rents StealC v2. Sibling Stage-2 (155dc737...) shares exfil infra via unknown delivery. 17 of 19 typosquats listed in indicators; full count = 19. Full write-up: see Reference.", "modified": "2026-05-05T08:32:48.235000", "created": "2026-05-05T08:32:48.235000", "tags": [ "typosquatting", "supply-chain", "github", "stealc", "stealc-v2", "malware-as-a-service", "python-dropper", "windows-stealer", "crypto-stealer", "chrome-abe-bypass", "nailproxy", "unicorn-binance-suite", "ubwa" ], "references": [ "https://blog.technopathy.club/nailproxy-space-github-malware-campaign" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "StealC", "display_name": "StealC", "target": null }, { "id": "StealC v2", "display_name": "StealC v2", "target": null } ], "attack_ids": [ { "id": "T1195", "name": "Supply Chain Compromise", "display_name": "T1195 - Supply Chain Compromise" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [ "Finance", "Software", "Cryptocurrency" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "oliver-zehentleitner", "id": "402971", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_402971/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 11, "FileHash-MD5": 1, "FileHash-IMPHASH": 2, "domain": 2, "hostname": 1, "URL": 19, "IPv4": 1, "FilePath": 3, "Mutex": 1 }, "indicator_count": 41, "is_author": false, "is_subscribing": null, "subscriber_count": 1, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "nailproxy.space", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "nailproxy.space", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780180332.9061706 }