Tag Archive for: stealer

Luca Stealer malware spreads after code appears on GitHub • The Register

/in


A new info-stealer malware is spreading rapidly in the wild as the developer behind it continues to add capabilities and recently released the source code on GitHub.

In addition, the Windows software nasty – dubbed Luca Stealer by the folks at Cyble who detected it – is the latest to be built using the Rust programming language.

The researchers wrote in a report that Luca Stealer already has been updated three times, with the developer adding multiple functions, and that they have seen more than 25 samples of the source code in the wild since it was shared via GitHub on July 3, which may lead to wider adoption by the cybercriminal community.

“The developer of the stealer appears to be new on the cybercrime forum and likely leaked the source code of the stealer to build a reputation for themselves,” the researchers wrote. “The developer has also provided the steps to modify the stealer and compile the source code for ease of use.”

They noted that Rust is becoming a go-to programming language for malware developers because of its versatility, cross-platform nature, and that the generated code can seem alien to some reverse engineers and their tools, hindering analysis. The prolific Hive ransomware crew this year migrated its source code from Go to Rust, which analysts with Microsoft’s Threat Intelligence Center earlier this month said made the exortionware more stable and more difficult to reverse engineer.

Other threat groups also are adopting Rust, including the BlackCat ransomware-as-a-service gang. In addition, Kaspersky security researchers this month wrote about a new ransomware family – Luna – that is written in Rust. We’re not too surprised by this: Rust is seen as an up and coming general-purpose language that programmers are using for all kinds of projects, legit and malicious.

“Rust is to C as Go is to Java,” Casey…

Source…

RIG Exploit Kit Now Infects Victims’ PCs With Dridex Instead of Raccoon Stealer

/in


RIG Exploit Kit

The operators behind the Rig Exploit Kit have swapped the Raccoon Stealer malware for the Dridex financial trojan as part of an ongoing campaign that commenced in January 2022.

The switch in modus operandi, spotted by Romanian company Bitdefender, comes in the wake of Raccoon Stealer temporarily closing the project after one of its team members responsible for critical operations passed away in the Russo-Ukrainian war in March 2022.

The Rig Exploit Kit is notable for its abuse of browser exploits to distribute an array of malware. First spotted in 2019, Raccoon Stealer is a credential-stealing trojan that’s advertised and sold on underground forums as a malware-as-a-service (MaaS) for $200 a month.

CyberSecurity

That said, the Raccoon Stealer actors are already working on a second version that’s expected to be “rewritten from scratch and optimized.” But the void left by the malware’s exit is being filled by other information stealers such as RedLine Stealer and Vidar.

Dridex (aka Bugat and Cridex), for its part, has the capability to download additional payloads, infiltrate browsers to steal customer login information entered on banking websites, capture screenshots, and log keystrokes, among others, through different modules that allow its functionality to be extended at will.

RIG Exploit Kit

In April 2022, Bitdefender discovered another Rig Exploit Kit campaign distributing the RedLine Stealer trojan by exploiting an Internet Explorer flaw patched by Microsoft last year (CVE-2021-26411).

CyberSecurity

That’s not all. Last May, a separate campaign exploited two scripting engine vulnerabilities in unpatched Internet Explorer browsers (CVE-2019-0752 and CVE-2018-8174) to deliver a malware called WastedLoader, so named for its similarities to WasterLocker but lacking the ransomware component.

“This once again demonstrates that threat actors are agile and quick to adapt to change,” the cybersecurity firm said. “By design, Rig Exploit Kit allows for rapid substitution of payloads in case of detection or compromise, which helps cyber criminal groups recover from disruption or environmental changes.”

Source...


[the_ad_group id="27628"]

Jester Stealer Is The Latest Infostealing Malware – Cyber Security News

/in



Jester Stealer Is The Latest Infostealing Malware  Cyber Security News

Source…

Panda Stealer malware targets digital currencies via Discord links, spam emails

/in


There’s a new malware that’s targeting digital currency wallets, spreading through spam emails and Discord channels. The malware, dubbed Panda Stealer, has mostly targeted victims in the U.S., Germany, Japan and Australia.

Security company Trend Micro was the first to detect the malware. In a recent blog post, the Tokyo-based firm revealed that Panda Stealer is delivered through spam emails posing as business quotes to lure unsuspecting victims into opening malicious Excel files.

The malware has two infection chains, the security company revealed. In the first, the criminals attach a .XLSM document that contains malicious macros. Once the victim enables the macros, the malware downloads and executes the main stealer.

In the second infection chain, the spam emails come with a .XLS attachment containing an Excel formula that hides a PowerShell command. This command attempts to access paste.ee, a Pastebin alternative, that in turn accesses a second encrypted PowerShell command. According to Trend Micro, this command is used to access URLs from paste.ee for easy implementation of fileless payloads.

“Once installed, Panda Stealer can collect details like private keys and records of past transactions from its victim’s various digital currency wallets, including Dash, Bytecoin, Litecoin, and Ethereum,” the company noted.

The malware doesn’t limit itself to digital currency wallets, however. It steals credentials to other applications such as Telegram, NordVPN, Discord and Steam. It’s also capable of taking screenshots of the infected computer and capturing and transmitting data from browsers like cookies and passwords.

Trend Micro found another 264 files similar to Panda Stealer on VirusTotal. Over 140 command and control (C&C) servers and over 10 downloaded sites were used by these samples.

It concluded, “Some of the download sites were from Discord, containing files with names such as “build.exe,” which indicates that threat actors may be using Discord to share the Panda Stealer build.”

Security researchers have linked the Panda Stealer malware campaign to an IP address assigned to virtual private servers rented from Shock Hosting. However, the hosting…

Source…