name: OTTERCOOKIE Stealer Upload to Rare DEV Domain via axios User-Agent Analytic
signatureid: PXY-WEB11-ERI
category: 'Exfiltration'
threatname: 'Exfiltration Over C2 Channel'
functionality: 'Web Proxy'
description: |
Detects the credential, wallet, and file exfiltration HTTP behavior of the REF9403 Contagious
Interview / OTTERCOOKIE stealer modules at the web-proxy layer, without depending on a specific
C2 domain that is likely to be sinkholed or rotated shortly after publication. The browser
credential / crypto wallet stealer and the file stealer both submit stolen data via HTTP POST to
a /upload endpoint (multipart for browser artifacts, raw files for the file stealer) and, for
wallet LevelDB stores, to a /cldbs endpoint. All stealer network requests are issued by the
malware's embedded HTTP client using the distinctive User-Agent axios/1.18.1. Rather than pinning
to rightwidth[.]dev, this rule matches the durable request signature (POST to /upload or /cldbs
carrying the axios/1.18.1 User-Agent) directed at a domain under the .dev TLD, then applies event
rarity on the destination domain. The .dev constraint is deliberate: applying rarity to every
destination makes almost any first-seen domain look rare (CDNs, SaaS, telemetry), producing
cold-start noise. Scoping to .dev both mirrors the campaign's observed infrastructure
(rightwidth[.]dev and its subdomains) and its likely rotation pattern, and reduces the rarity
population to a TLD that is an uncommon POST-exfil destination in most enterprise environments.
The rule fires when the stealer HTTP signature is sent to a .dev domain that is rare for the host
over the baseline window, catching the same behavior against new .dev infrastructure the actor
rotates to.
reference:
- https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography
- https://attack.mitre.org/techniques/T1041/
- https://attack.mitre.org/techniques/T1555/003/
labels:
- attack.exfiltration
- attack.t1041
- attack.credential_access
- attack.t1555
- attack.t1555.003
- attack.collection
- attack.t1005
- OTTERCOOKIE
- Contagious_Interview
- REF9403
- DPRK
- APT
logsource:
product: Web Proxy
category: proxy
detection:
selection_method:
Method: POST
selection_stealer_paths:
CsUriPath|contains:
- '/upload'
- '/cldbs'
selection_axios_ua:
RequestClientApplication|contains:
- 'axios/1.18.1'
- 'axios/1.18'
selection_dev_tld:
DomainName|endswith:
- '.dev'
condition: selection_method and selection_stealer_paths and selection_axios_ua and selection_dev_tld
analytical_type:
event_rarity:
feature:
- DomainName
sigma: 0.60
technique: 'Rare Activity on Resource Group'
baseline: '7 days'
criticality: High
verbose_info:
violation_summary:
grouping_attribute: 'accountname'
level2_attribute: 'devicehostname'
level2_metadata_attributes:TECHNICAL DETAILS
Exfiltration HTTP behavior (domain-independent anchors):
Browser cred / wallet stealer
POST /upload (multipart: Login Data, Web Data, Local Extension Settings)
POST /cldbs (wallet LevelDB stores; first 8 priority wallets acked+retried,
remaining wallets fire-and-forget)
File stealer
POST /upload (raw matched files, no additional encryption/compression)
Process title set to "npm-cache" to masquerade in task listings.
All requests carry User-Agent: axios/1.18.1
Known campaign infrastructure at time of reporting (for retro-hunt / enrichment only,
NOT used as a live selector here because it will be burned quickly):
rightwidth[.]dev, ldb.rightwidth[.]dev, upload.rightwidth[.]dev,
controller.rightwidth[.]dev, file.rightwidth[.]dev
195.26.248[.]212, 188.40.64[.]61
Wallet extension IDs targeted (25 total) include MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn),
Phantom, Rabby, Keplr, Trust, TronLink, OKX, etc. macOS runs also exfiltrate
~/Library/Keychains/login.keychain-db through the same module.
Rarity rationale:
- The axios/1.18.1 UA + /upload|/cldbs POST is the durable, domain-independent signature.
- The .dev TLD selector runs as STATIC logic BEFORE rarity. Without a static domain
constraint, rarity on DomainName treats nearly every first-seen destination as rare,
which floods on cold-start and in high-cardinality egress. Gating on .dev first shrinks
the rarity population to a TLD the actor actually used and that is an uncommon
POST-exfil target in most enterprises.
- event_rarity on DomainName then surfaces that signature when it is sent to a .dev
destination that is rare for the environment over the baseline — exactly the condition
when the actor stands up fresh .dev C2 after the original domain is sinkholed.
- Trade-off: if the actor rotates to a non-.dev TLD, this rule will not fire.
False Positives:
- Low. Requires the specific axios build UA, a stealer-style upload path, AND a rare
destination. Allowlist any sanctioned tool that genuinely uses axios/1.18.x to POST
to a rarely-contacted /upload endpoint.
Policy building walkthrough can be found in this previous post: