Facebook Advertising Spreads Novel Malware Variant

In early December, during an Advanced Continual Threat Hunt (ACTH) campaign investigation, LevelBlue SpiderLabs discovered a new malware named Ov3r_Stealer.

At a high level, this malware is designed to steal credentials and crypto wallets and send those to a Telegram channel that the threat actor monitors. The tactics and techniques to drop the malware and the code itself is not unique, but because this malware was relatively unknown at the time of discovery, it allowed our investigators to dig a little deeper into its backstory and potentially the origins of this malware.