Skip to content

MALICIOUS (1) campaign cataloged at 2024-08-10(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2024-08-sleipnirbrowser-web3

Once run, downloads and install from sleipnirbrowser[.]org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some kind of crypto tokens, and trying to impersonate a legitimate Slepnir web browser (https://en.wikipedia.org/wiki/Sleipnir_(web_browser)).

Later versions switched to install a software identified as LUMMA infostealer (e.g. https://tria.ge/240817-whze2aydkc), hidden in different executables

Abuse categories

crypto-related

Campaign uses crypto-related.

dependency-confusion

Campaign uses dependency-confusion.

impersonation

Campaign uses impersonation.

modify-system-without-consent

Campaign uses modify-system-without-consent.

remote_executable

Downloads and executes a remote executable.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • sleipnirbrowser.org

  • hxxps://sleipnirbrowser.org/api/python/14526470/win

  • hxxps://sleipnirbrowser.org/api/python/79D83767/mac

  • hxxps://sleipnirbrowser.org/api/python/79D83767/win

Packages in the campaign

campaign:2024-08-sleipnirbrowser-web3