Datadog Security Labs · Crawled Jul 25, 2026
The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions | Datadog Security Labs
23 IoCs 1 Malware
Read original article ↗
AI Summary
MUT-9332 is a threat actor targeting Solidity developers via malicious Visual Studio Code extensions named solaibot, among-eth, and blankebesxstnion. These extensions deliver multi-stage malware that establishes persistence, disables security controls, and exfiltrates cryptocurrency wallet credentials. The campaign uses obfuscated scripts, steganography, and multiple command-and-control domains to evade detection, with infrastructure reuse indicating links to a prior Monero cryptominer campaign.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 23 extracted
| Type | Value | Detail |
|---|---|---|
| Domain | solidity[.]bot | Details → |
| Domain | myaunet[.]su | Details → |
| Domain | paste[.]ee | Details → |
| Domain | m-vn[.]ws | Details → |
| Domain | begalinokotobananinotrippitroppacrocofanclub[.]su | Details → |
| Domain | archive[.]org | Details → |
| SHA-256 | ce72b79e324371134db762fe70b8b1789af899d7217461bc3658a6bd84743eb6 | Details → |
| SHA-256 | e19d5d8f941b9a98fbb3b65e1e6077fa00d97529e351e455297b0204ec07e9ed | Details → |
| SHA-256 | 209fb5bb2440ffe1a631dfe3b574229105a33c5153eded023cc77d8e8f81d1de | Details → |
| SHA-256 | e0ca66c1a9a68b319b24a7c6b8fdca219dffd802dd4de2d59f602c4d90f40d6c | Details → |
| SHA-256 | c5c0228a1e0ba2bb748219325f66acf17078a26165b45728d8e98150377aa068 | Details → |
| SHA-256 | a1eadd41327bd8736e275627d3953944fe7089c032d72a3e429ff18ad0958ada | Details → |
| SHA-256 | c3684164933c3f54d5b0b242a8a906a85d633de479079a820bb804c0f73c0f58 | Details → |
| Filename | extension.zip | Details → |
| Filename | myau.exe | Details → |
| Filename | myaunet.exe | Details → |
| Filename | wmam.exe | Details → |
| Filename | a.txt | Details → |
| Filename | 1.txt | Details → |
| Filename | 2.txt | Details → |
| Filename | 3.txt | Details → |
| Filename | a.vbs | Details → |
| Filename | Launch.exe | Details → |
MITRE ATT&CK TTPs 38 techniques
T1055 Process Injection · Defense Evasion T1055.003 Thread Execution Hijacking · Defense Evasion T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1112 Modify Registry · Defense Evasion T1129 Shared Modules · Execution T1134 Access Token Manipulation · Defense Evasion T1137 Office Application Startup · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1176 Browser Extensions · Persistence T1190 Exploit Public-Facing Application · Initial Access T1197 BITS Jobs · Defense Evasion T1203 Exploitation for Client Execution · Execution T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1218 System Binary Proxy Execution · Defense Evasion T1218.011 Rundll32 · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1497.001 System Checks · Defense Evasion T1547.001 Registry Run Keys / Startup Folder · Persistence T1553.005 Mark-of-the-Web Bypass · Defense Evasion T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1571 Non-Standard Port · Command And Control T1573 Encrypted Channel · Command And Control T1574.002 DLL Side-Loading · Persistence T1583 Acquire Infrastructure · Resource Development T1584 Compromise Infrastructure · Resource Development T1586 Compromise Accounts · Resource Development T1595.002 Vulnerability Scanning · Reconnaissance