mails_grabber

mails_grabber is an 8 KB email harvesting tool from the Algerian underground scene, notable for leaking two distinct author identities in a single file. The UI layer is attributed to SparkyDz (with a Facebook profile link embedded in the source), while the core extraction engine — a function that performs the actual database walking — is credited to a separate author known as G-B (with a different Facebook profile). This dual-author signal in such a small file suggests either a collaborative build or code reuse from an existing library.

Capabilities

The tool ships with zero authentication and operates in two modes. In single mode, it connects to the local MySQL server using credentials supplied by the operator and walks every database, every table, and every column, applying a regex filter to identify fields containing email addresses. Matches are validated, deduplicated, and appended to a local file. In bulk mode, the operator pastes a list of MySQL username/password pairs — typically harvested from CMS config files by a companion grabber — and the tool iterates through each, performing the same exhaustive enumeration across every accessible database instance.

The tool leaks several passive indicators during operation: it loads jQuery from a public CDN, pulls a Google Font, and references a loading animation from an external image host. These external resource loads create network artifacts even when the tool itself generates no outbound data exfiltration — the harvested emails stay on disk, but the page load phones home to three unrelated domains.

Vulnerabilities

The runtime dependency is strict: mails_grabber uses legacy PHP functions (mysql_connect, eregi) that were removed in PHP 7.0. It runs only on PHP 5.6 hosts. On modern servers, it fails silently. This PHP 5.x dependency is an implicit age marker — the tool was built for an era of shared hosting where PHP 5.x was standard and MySQL credentials in wp-config.php were the universal currency.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_mails_grabber {
    meta:
        description = "mails_grabber database email harvester (SparkyDz / G-B)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/mails-grabber/"

    strings:
        $sparkydz   = "SparkyDz" ascii nocase
        $gb_author  = "G-B" ascii
        $mysql_q    = "mysql_query" ascii
        $show_db    = "SHOW DATABASES" ascii
        $show_tbl   = "SHOW TABLES" ascii
        $regex_mail = "[a-z0-9._%+-]+@[a-z0-9.-]" ascii

    condition:
        filesize < 20KB
        and ($sparkydz or $gb_author)
        and $mysql_q
        and ($show_db or $show_tbl or $regex_mail)
}

MITRE ATT&CK

OHIIHO Threat Research.