Fake Chocolatey and Microsoft activation sites distribute ArmorSteal
Original title: Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware
Zscaler says the September campaign's Python malware also logs keystrokes, swaps wallet addresses, and checks C2 every 60 seconds.
Zscaler's Threat Hunting team says attackers used search poisoning to promote typosquatted Chocolatey and Microsoft Activation Scripts sites that served ArmorSteal. The choclatey[.]org installer ran the legitimate Chocolatey package while deploying a Pyarmor-protected Python kit that persists through scheduled tasks SysCheck2 and SysCheckX. Modules provide remote tasking, keylogging, clipboard crypto-address replacement, and theft of browser, Discord, and wallet data. Both lure sites later went offline, and operators moved toward pymons[.]is and datamons[.]org.
- A shared RSA-2048 task-signing key linked choclatey[.]org and massgravel[.]net.
- Payloads land in C:\Windows\SystemHealth\Update with Python 3.11 and Pyarmor 9.1.7.
- SysCheckX runs the remote-access module as SYSTEM 45 seconds after startup.
- The stealer reads cookies through Chrome DevTools Protocol on port 9222.
- Zscaler published findings on October 22 after identifying the campaign in September.
Impact: Steals passwords, cookies, tokens, and cryptocurrency wallet data
- 1.Hunt scheduled tasks SysCheck2 and SysCheckX and the SystemHealth directory.
- 2.Review PowerShell downloads and browser remote-debugging on port 9222.
- 3.Remove unauthorized Microsoft Defender exclusions tied to the infection.
- ATT&CK
- T1059.001 PowerShellT1053.005 Scheduled TaskT1056.001 KeyloggingT1555.003 Credentials from Web BrowsersT1115 Clipboard Data
- Malware
- ArmorSteal
- Organizations
- Zscaler
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | choclatey.org | y and Microsoft Activation Websites The typosquatted domain choclatey[.]org impersonated Chocolatey and displayed a malicious PowerSh |
| domain | datamons.org | ne, operators shifted infrastructure toward pymons[.]is and datamons[.]org. Defenders should investigate the scheduled tasks, inspec |
| domain | massgravel.net | and reducing visible signs of compromise. A second domain, massgravel[.]net, impersonated the Microsoft Activation Scripts project. S |
| domain | niceer.net | datamons[.]org — Initially standby C2; later active Domain niceer[.]net — Standby C2 Domain supertrap[.]net — Standby C2 IP addre |
| domain | pymons.is | sites went offline, operators shifted infrastructure toward pymons[.]is and datamons[.]org. Defenders should investigate the sche |
| domain | supertrap.net | by C2; later active Domain niceer[.]net — Standby C2 Domain supertrap[.]net — Standby C2 IP address 82[.]153[.]135[.]80 — Payload hos |
| domain | workerstats.net | tey domain Domain massgravel[.]net — Fake MAS domain Domain workerstats[.]net — C2 domain Domain pymons[.]is — C2 domain Domain datamon |
| ipv4 | 186.2.163.185 | t IP address 186[.]2[.]175[.]183 — C2 IP address IP address 186[.]2[.]163[.]185 — C2 IP address IP address 190[.]115[.]31[.]69 — C2 I |
| ipv4 | 186.2.175.183 | C2 IP address 82[.]153[.]135[.]80 — Payload host IP address 186[.]2[.]175[.]183 — C2 IP address IP address 186[.]2[.]163[.]185 — C2 I |
| ipv4 | 190.115.31.69 | s IP address 186[.]2[.]163[.]185 — C2 IP address IP address 190[.]115[.]31[.]69 — C2 IP address IP address 209[.]99[.]186[.]187 — Pay |
| ipv4 | 209.99.186.187 | s IP address 190[.]115[.]31[.]69 — C2 IP address IP address 209[.]99[.]186[.]187 — Payload host Note: IP addresses and domains are int |
| ipv4 | 82.153.135.80 | — Standby C2 Domain supertrap[.]net — Standby C2 IP address 82[.]153[.]135[.]80 — Payload host IP address 186[.]2[.]175[.]183 — C2 IP |
| sha256 | 04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74 | dd8fe575f5077db3c84e5f getthem20084.zip Stealer module File 04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74 nig20083.zip Older stealer module File 56f05c4fb1c25c04e0dd |
| sha256 | 0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499 | eb52a55f82106389 getthem20083.zip Older stealer module File 0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499 SysMon.py Remote access module File 8fb7aaf2b9270b8b75f6844 |
| sha256 | 237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31 | c58f4c97 Update.zip / Updatef.zip Remote access module File 237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31 nig20084.zip Surveillance module File be0329d0795dd62ae587f |
| sha256 | 3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97 | fd150454cb01b292 install.ps1 Chocolatey lure installer File 3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97 Update.zip / Updatef.zip Remote access module File 237ba698 |
| sha256 | 5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c | b89cba10fff3d9b908a769788 basrq.py Surveillance module File 5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c got.py Stealer module Domain choclatey[.]org — Fake Chocola |
| sha256 | 56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389 | 4e773212cd601e49fa74 nig20083.zip Older stealer module File 56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389 getthem20083.zip Older stealer module File 0ea99fbbe29af6f7 |
| sha256 | 8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788 | 990a8c382a715069f156499 SysMon.py Remote access module File 8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788 basrq.py Surveillance module File 5410c2f239c3649928383c447 |
| sha256 | be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f | 9b3a7d4e18683f871ee31 nig20084.zip Surveillance module File be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f getthem20084.zip Stealer module File 04d2828155ed2a276cfd3c |
| sha256 | f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9 | IOCs Category Indicator / SHA256 Filename Description File f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9 install.ps1 MAS lure installer File fb1181160e9f10ce1eb5e5d |
| sha256 | fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292 | 29344acfb96ff83fff994f9 install.ps1 MAS lure installer File fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292 install.ps1 Chocolatey lure installer File 3e3b62a9836697d9 |
From the original article
3 min read at gbhackers.com
Hackers are distributing ArmorSteal, a Python-based malware family, through fake Chocolatey and Microsoft Activation-Script websites promoted via search engine poisoning. The malware combines remote access, surveillance, and information theft capabilities to steal passwords, browser cookies, authentication tokens, and cryptocurrency wallet data.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.