{"id":"47b980b67c04e5eb093ff5e6c442a24a","title":"Sputnik_Stealer — Sputnik_Stealer · 木马/恶意软件 · PE32","md5":"47b980b67c04e5eb093ff5e6c442a24a","sha256":"b5521572bfd95f011e23efa78e1e14da6e941270f3c40e362de476c0a549caab","family":"Sputnik_Stealer","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Go","file_format":"PE32","compiler":"Go_1.18","published_at":"2026-08-08T16:00:00.000Z","summary":"Go 1.18+ 编译的高级信息窃取木马 (Info-Stealer)，UPX 5.02 加壳。 窃取目标： 加密货币钱包 (20+)：Metamask, Trust Wallet, AtomicWallet, Electrum, Coinbase, Jaxx Liberty, TerraStation, Bytecoin, Ethereum, Crocobit, Starcoin, Liquality, Maiar DEFI, TonKeeper, SuiWallet, MyMonero 浏览器密码/Cookie：Chrome, Firefox, Chromium, SeaMonkey, IceDragon, Pale Moon, DCBrowser, Cyberfox, BlackHaw, K-Meleon, Waterfox, Elements, QIP Surf 系统凭据：LSASS 进程访问、SYSTEM 令牌模拟 (DuplicateTokenEx) Steam 凭据：SteamPath 路径枚举 C2 通信： QUIC (quic-go) 协议加密通信 HTTP/HTTPS + WebSocket 多通道 DNS over HTTPS (cloudflare-dns.com, dns.google) HTTP/2 + HTTP/3 支持 代理支持 (HTTP_PROXY) 持久化： Windows 计划任务 (ITaskService) Mutex: Local\\Sputnik\\Sputnik\\User Data (防多开) 窃取方法： Chrome: SELECT origin_url, username_value, password_value FROM logins Firefox: SELECT origin_url, username_value, password_value FROM logins Cookie: SELECT name,encrypted_value,host_key,path,expires_utc FROM cookies","url":"https://zseceye.com/report/47b980b67c04e5eb093ff5e6c442a24a","json_url":"https://zseceye.com/report/47b980b67c04e5eb093ff5e6c442a24a.json","html_url":"https://zseceye.com/report/47b980b67c04e5eb093ff5e6c442a24a","hash_urls":{"md5":"https://zseceye.com/hash/47b980b67c04e5eb093ff5e6c442a24a","sha256":"https://zseceye.com/hash/b5521572bfd95f011e23efa78e1e14da6e941270f3c40e362de476c0a549caab"},"search_urls":{"md5":"https://zseceye.com/?q=47b980b67c04e5eb093ff5e6c442a24a","sha256":"https://zseceye.com/?q=b5521572bfd95f011e23efa78e1e14da6e941270f3c40e362de476c0a549caab"},"sample_download_url":"https://zseceye.com/report/47b980b67c04e5eb093ff5e6c442a24a/sample","sample_filename":"b5521572bfd95f01.zip","iocs":[],"ips":[]}