Procedure examples

BeaverTail has added junk data or a dummy character prepended to a string to hamper decoding attempts.

BeaverTail has exfiltrated data collected from local systems.

BeaverTail has obfuscated strings of code with Base64 encoding within the JavaScript version of the malware. BeaverTail has also utilized the open-source tool JavaScript-Obfuscator to obfuscate strings and functions.

BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.

BeaverTail has exfiltrated data collected from victim devices to C2 servers.

BeaverTail has executed malicious JavaScript code. BeaverTail has also been compiled with the Qt framework to execute in both Windows and macOS.

BeaverTail has deleted files from a compromised host after they were exfiltrated.

BeaverTail has used HTTP GET request to download malicious payloads to include InvisibleFerret and HTTP POST to exfiltrate data to C2 infrastructure.

BeaverTail has staged collected data to the system’s temporary directory.

BeaverTail has been known to collect basic system information. BeaverTail has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.

BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

BeaverTail has obtained and sent the current timestamp associated with the victim device to C2.

BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.

BeaverTail has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference. BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

BeaverTail has collected keys stored for Solana stored in `.config/solana/id.json` and other login details associated with macOS within `/Library/Keychains/login.keychain` or for Linux within `/.local/share/keyrings`.

BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

BeaverTail has collected and archived sensitive data in a zip file.

BeaverTail has communicated with C2 IP addresses over ports 1224 or 1244.

BeaverTail has identified .ldb and .log files stored in browser extension directories for collection and exfiltration.

BeaverTail has searched the victim device for browser extensions commonly associated with cryptocurrency wallets.