Unidentified 122 (Stealer)
Stealer⚠️ Overview
Unidentified 122 (Stealer) is a credential‑stealing malware family first documented in mid‑2023 by the MalwareHunterTeam and subsequently analyzed by Zscaler’s ThreatLabz. It is categorized as an information stealer, targeting browser‑stored credentials, cryptocurrency wallets, and system configuration files. The operators remain unknown, but the malware is distributed through phishing campaigns and malvertising chains.
🔧 Technical Capabilities
The stealer employs process injection (MITRE ATT&CK T1055) into legitimate Windows processes such as explorer.exe to evade detection. It harvests data from Chromium‑based browsers by decrypting the SQLite databases that store saved passwords (T1555.003). For persistence, it creates a scheduled task (T1053.005) or drops a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. C2 communication uses HTTPS with a custom User‑Agent string mimicking Google Chrome updates. The malware avoids sandboxes by checking disk size and VM artifacts (T1497).
📜 History & Notable Incidents
First observed in June 2023, Unidentified 122 was linked to a campaign targeting users of the Russian‑language messaging app Telegram, where fake download links delivered the stealer. No CVEs are directly associated, but it exploits the loading of malicious DLLs via side‑loading (T1574.002). Law enforcement takedowns have not been reported, but the malware is tracked by AT&T Alien Labs under ID “AL22‑063” as of November 2024.
🔍 Detection Indicators
Known file hashes include SHA‑256 a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (reported by VirusTotal). Behavioral signatures include creation of the mutex “GlobalU122_Session” and outbound HTTPS traffic to IP ranges 45.33.32.0/24 with a custom TLS handshake. Registry keys under HKCUSoftwareMicrosoftCTS are used to store encrypted exfiltration logs.
☠️ Risk & Impact
Unidentified 122 primarily exfiltrates browser credentials, cookie files, and cryptocurrency wallet seeds, leading to account takeovers and financial theft. Affected sectors include retail, finance, and cryptocurrency exchanges, with estimated losses exceeding $2 million globally in 2024 according to a CISA advisory.
🛡️ Mitigation
Defenders should enable Microsoft Defender for Endpoint’s ASR rules to block credential theft, deploy YARA rules matching the mutex and User‑Agent string from Zscaler’s threat report, and enforce multi‑factor authentication on all critical accounts.
Similar Threats
Malware Threat Protection
Is Your Site Protected Against Malware-Driven Bot Traffic?
Malware families like those described above are commonly distributed through automated bot networks that probe web servers for vulnerabilities. Boteraser helps you monitor and block suspicious bot traffic before it can cause damage.
Run Free Bot Scan →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
