Post

New Octowave Loader sample is leading to Amatera Stealer deployment over the past week. 0 VT detections on any component of the malware loader. Proofpoint rules detect the outbound C2 traffic. My Yara rule detects the installer.

CyberRaiju

@jaiminton.com

Adobe printer driver sideloads tbb.dll, tbb.dll loads app-2.3.dll which gets stego from blood.wav, uses zxing.presentation.dll and Xceed.Wpf.AvalonDock.Themes.Aero.dll MSI: www.virustotal.com/gui/file/f5c... Components all with 0 VT detections. DLLs are legitimate ones that were modified.

24/6/25, 3:11 am0 reposts1 like

CyberRaiju

@jaiminton.com

24 June 2025

TBB: www.virustotal.com/gui/file/f5c... APP-2.3: www.virustotal.com/gui/file/b50... ZXING: www.virustotal.com/gui/file/f4c... XCEED: www.virustotal.com/gui/file/118... BLOOD: www.virustotal.com/gui/file/d96...

virustotal.comVirusTotalVirusTotal

CyberRaiju

@jaiminton.com

24 June 2025

Masquerading as `IO Broker Installer` on disk from the compiled MSI that seems to have artifacts from a SyslogCenter executable previously used by Octowave Loader that was still left in the MSI. PR made to #hijacklibs github.com/wietze/Hijac...

github.comCreate tbb.yml by JPMinty · Pull Request #128 · wietze/HijackLibsNew Octowave variant using this to deliver ACR/Amatera Stealer