A recently identified data stealer is using Telegram to exfiltrate information harvested from infected machines, Juniper Networks security researchers say.
Marketed on underground forums as “Masad Clipper and Stealer,” the malware targets browser data, in an attempt to collect from there usernames, passwords and credit card information. Additionally, the threat can replace cryptocurrency wallet addresses on the clipboard with its own.
Written using AutoIt scripts and compiled into a Windows executable, Masad Stealer’s binary is only 1.5 MB in size. However, it can also be found bundled into other software, the researchers say.
When executed, the malware drops itself in %APPDATA%folder_name}{file_name}. For persistence, it creates a scheduled task to start itself every minute.
Next, Masad Stealer starts collecting sensitive information from the system, including cryptocurrency wallet data, PC and system information, credit card data and passwords from browsers, installed software and processes, desktop files, browser cookies, Steam files, AutoFill browser fields, Discord and Telegram data, and FileZilla files, and also takes a screenshot of the desktop.
The information is archived using 7zip, which is bundled into the malware binary. The ZIP file is sent to the command and control (C&C) server using a hardcoded bot token, via the sendDocument Telegram bot API, Juniper Networks says.
When establishing communication between the C&C and the bot, a getMe message using the bot token is sent, to which the bot responds with the user object containing the username of the bot. With multiple actors using this malware, the username object is useful for identification purposes.
Masad Stealer can replace crypto-wallets on the clipboard with attacker-specified wallets, if they match particul ..
Support the originator by clicking the read the rest link below.
