ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Z*Stealer

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Z*Stealer

NamesZ*Stealer
CategoryMalware
TypeBackdoor, Credential stealer
Description(Forecepoint) ZS.DLL.C is another Delphi based library, this time for stealing both OS and application login credentials. As with the cryptocurrency stealer, once the password scan is completed the extracted information is transferred to the C2 by HTTP POST request to a PHP page on the server side.

Based on data retrieved from the C2 servers, the credential stealing capability seems to be comparatively successful at retrieving data. A range of commonly used applications are supported.
Information<https://www.forcepoint.com/blog/x-labs/quantize-or-capitalize>

Last change to this tool card: 20 April 2020

Download this tool card in JSON format

Previous: ZPP
Next: ZUMKONG

All groups using tool Z*Stealer

ChangedNameCountryObserved

Other groups

 Guru SpiderRussia2014-Mar 2018 

1 group listed (0 APT, 1 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key