Tool: OLDBAIT| Names | OLDBAIT Sasfis | |
| Category | Malware | |
| Type | Credential stealer | |
| Description | (FireEye) OLDBAIT is a credential harvester that installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe. There is a missing space in the MediaPlayer directory and the filename is missing the ‘o’ character. Both the internal strings and logic are obfuscated and are unpacked at startup. Credentials for the following applications are collected: • Internet Explorer • Mozilla Firefox • Eudora • The Bat! (an email client made by a Moldovan company) • Becky! (an email client made by a Japanese company) Both email and HTTP can be used to send out the collected credentials. | |
| Information | <https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf> <https://www.secjuice.com/fancy-bear-review/> | |
| MITRE ATT&CK | <https://attack.mitre.org/software/S0138/> | |
| Malpedia | <https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait> | |
Last change to this tool card: 13 May 2020
Download this tool card in JSON format
| Changed | Name | Country | Observed | ||
APT groups | |||||
| Sofacy, APT 28, Fancy Bear, Sednit |  | 2004-Jun 2021 |  | ||
1 group listed (1 APT, 0 other, 0 unknown)
|
Thailand Computer Emergency Response Team (ThaiCERT) Follow us on
|
Report incidents |
|
 |
+66 (0)2-123-1234 | |
 |
report@thaicert.or.th | |
 |
Download PGP key | |