C2 server for PySteal infostealer (HEUR:Trojan.Multi.Powesta.d). Malware was dropped on a Windows 11 ...
show moreC2 server for PySteal infostealer (HEUR:Trojan.Multi.Powesta.d). Malware was dropped on a Windows 11 workstation on 03/04/2026 via a folder named SAM_Support_Session. It used Windows DPAPI (CryptUnprotectData) to decrypt browser-saved passwords, and sqlite3 to read Chrome/Edge credential and cookie databases directly. Stolen data was encrypted with RSA/AES and exfiltrated to this IP on port 56001. Malware included evidence-clearing and exfiltration scripts containing Chinese characters. The attacker used a stolen PayPal session cookie to make an unauthorised financial transaction without requiring login or 2FA. Kaspersky Rescue Disk detected persistence via HKCU Run keys (SAM_Panel_Backup, SAM_Data_ClearBin). Infection confirmed active 03/04/2026–12/05/2026.
show less
This IP was observed as active C2 infrastructure for a PySteal infostealer (Troj/PySteal-BT) infecti ...
show moreThis IP was observed as active C2 infrastructure for a PySteal infostealer (Troj/PySteal-BT) infection on a Windows endpoint. Two python.exe processes originating from a malicious dropper staged in AppData established persistent outbound connections to 103.209.61.108:56001. The malware was delivered via obfuscated batch file launchers using environment variable substitution to evade AV. The payload (python.txt, SHA256: d3bb9ce36b89f8a2e5a1b916b3273e7f6fc21f918eab2d0b098171ea99a03e20) was confirmed malicious by Sophos, ESET-NOD32, ZoneAlarm, and Google on VirusTotal (4/16). Shodan shows open ports 135, 445, 5985 (WinRM) on this IP consistent with a compromised Windows VPS used as C2.
show less