RootTeam Stealer and overlap issues on Bandit Stealer rule detection

Rule Signatures
3

a new variant has discovered of this stealer, currently there’s no rule detection. CnC exfil changed now log is being uploaded as base64 in a single request.

I dont know why 2046806 - Win32/RootTeam Stealer CnC Exfil M2. # Detects POST to /api/report is not being pushed

OLD:
Analysis Launcher.exe (MD5: 525ECA0E85C3325ECA5B5B3CFEACD241) Malicious activity - Interactive analysis ANY.RUN

NEW:
Analysis LaLauncher.exe (MD5: 43A3997C24E25E4B25F66AFF503ACE89) Malicious activity - Interactive analysis ANY.RUN

the other PE file being dropped by this stealer is a clipper that now is being loaded by the new variants too

1 Like