NeedleStealer 🪡🪝 written in Go ⤵️ 🔎 HTTP user agents observed: User-Agent: Loader-cli/v1 user-agent: Go-http-client/2.0 📡 Botnet C2s, all behind Cloudflare CDN: http://woolvilli .com/api/v2 http://allremdeskriki .com/api/v2 http://dubl1allremriki .com/api/v2 http://dubl2allremriki .com/api/v2 💡 Related C2 infrastructure at Vultr 🇳🇱: http://136.244.100 .54:8899/api/v1/agent/register http://136.244.100 .54:8899/api/v1/agent/ws ⚱️ Artifacts: \Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle C:\Users\user\AppData\Local\Temp\needle-2fa 📄 Malware samples: https://bazaar.abuse.ch/browse/signature/NeedleStealer/ 🦊 Relevant IOCs are on ThreatFox: https://threatfox.abuse.ch/browse/tag/NeedleStealer/ Stealer admin panel⤵️