Skip to content

Ledger wallet implant

Named by 2 kept items in this workspace.

Search every workspace for Ledger wallet implant. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
    writeup2026-09-15

    Third stage-three payload using same crypter, Lenovo disguise, and MsBuild hollowing technique; creates a Run key named 'Ledger Wallet Installer', searches for Ledger Live/Ledger Wallet installations, hides bot ID in app.crc32 file, polls C2 for commands

  • Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
    writeup2026-08-19

    Third payload delivered via the fake DocSend chain; creates 'Ledger Wallet Installer' registry Run entry, enumerates Ledger Live/Ledger Wallet installs, stores bot ID in %APPDATA%\Ledger Live\app.crc32, and polls https://eu07connect[.]com/api/commands/<bot id>; persistence incomplete (bare MsBuild i

All threat actors in this workspace.