# Wrong malware family attribution 123Stealer

**URL:** <https://community.emergingthreats.net/t/wrong-malware-family-attribution-123stealer/3168>\
**Category:** Rule Signatures\
**Created:** [January 15, 2026, 12:36pm UTC](https://community.emergingthreats.net/t/wrong-malware-family-attribution-123stealer/3168 "2026-01-15T12:36:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chekin88](https://avatars.discourse-cdn.com/v4/letter/c/958977/32.png) [@chekin88](https://community.emergingthreats.net/u/chekin88)\
**Post date:** [January 15, 2026, 12:36pm UTC](https://community.emergingthreats.net/t/wrong-malware-family-attribution-123stealer/3168/1 "2026-01-15T12:36:19Z")

</div>

Hi!

Our network malware detection team discovered potential incorrect attribution of a malware family in the signatures:  
`ET MALWARE 123Stealer Victim CnC Checkin (POST) sid: 2066685`  
`ET MALWARE 123Stealer Victim CnC Checkin (GET) sid: 2066687`  
`ET MALWARE 123Stealer CnC Command Inbound (Ping) sid: 2066688`

We suspect that they were developed based on the tweet [https://x.com/solostalking/status/2001147307056918840](https://x.com/solostalking/status/2001147307056918840), which mentions the malicious C2 with 123Stealer admin page.

However, I’d like to point your attention to the Sysdig report ([EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks | Sysdig](https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks#enter-etherrat-a-four-stage-attack-chain)), which provides examples of C2 communication protocols that match the signatures:  
**sid 2066685** is not shown in the report and is the result of the received payload.  
**sid 2066687 is shown in the report (Section “C2 traffic patterns and command execution”).**

Also, tweet mentions TCP port 3003, while in the sandboxes, samples communicate on port 3000.

Reference runs in public Sandboxes:

> **[Automated Malware Analysis Report for fdsgsdf\_gfsadfasdf.msi - Generated by...](https://www.joesandbox.com/analysis/1835711/0/html)**
>
> Deep Malware Analysis - Joe Sandbox Analysis Report

> **[Analysis gfdsgsdfhfsd\_ghsfdgsfdgsdfg.sh (MD5:...](https://app.any.run/tasks/c91b7919-3b59-4807-ba13-39667413dfa3)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

 ![изображение](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/2X/3/37b66652c1b784e9b5bfa615527426ae19e2cf3e.png)

 ![изображение](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/2X/9/9ce351035c9e9a05706215ad5d06c84be474ba49.png)

Perhaps it’s worth renaming the specified signatures to EtherRAT?

Best regards,  
Evgeny Bechkalo, AVLab Positive Technologies

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [January 15, 2026, 8:54pm UTC](https://community.emergingthreats.net/t/wrong-malware-family-attribution-123stealer/3168/2 "2026-01-15T20:54:20Z")

</div>

Hey Evgeny!

Thanks for the thorough analysis! When I originally wrote the rule I attributed this to 123Stealer because of the C2 panel that was hosted on the dst IP `91.215.85[.]42`. This Sysdig report is excellent.

I’ve updated the rule names, metadata, and flowbits in today’s release. Thanks again for taking the time to reach out! 🔥

-Isaac