La escena del malware tiene una nueva entidad en el bloque: Ladrón enojado, a rebrand of Rage Stealer. Esto no es sólo una actualización de malware; es un salto a un ámbito donde sus datos privados se obtienen utilizando una plataforma tan común como Telegram. Imagina esto: un robot que ingresa a su sistema y toma todo: sus datos de inicio de sesión, banking info, even your crypto wallets.
The malware uses a Telegram bot API to orchestrate data theft, enabling it to operate without direct control by the attacker. This automation makes it dangerous as it can operate continuously, constantly exfiltrating data without manual intervention.
Angry Stealer Overview
Angry Stealer is packaged with payloads like MotherRussia.exe, enhancing its capabilities. It is a 32-bit Win32 executable, typically written in .NET, designed for widespread compatibility across various systems.
Stolen Data
- Login credentials
- Banking information
- Cryptocurrency wallets
- Browsing history
Payload Analysis
| Property | Value |
|---|---|
| MD5 | 08C3CB87AA0BF981A3503C116A952B04 |
| SHA-256 | bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d |
| File Type | Win32 EXE |
The binary acts as a dropper, creating and executing payloads like Stepasha.exe y MotherRussia.exe within the system’s temporary directories, executing these to perform their designated tasks.
Execution Process
Upon execution, the malware performs a series of actions:
- Checks for existing instances to prevent duplication.
- Creates and executes embedded payloads to avoid detection.
- Collects and exfiltrates data through a pre-configured Telegram channel.
El “Ladrón enojado” Telegram channel operates as a hub for marketing and disseminating the malware. Its description credits the development to “@InfoSecSpy,” and provides a direct contact “t.me/Xrebone” for interactions. This channel is actively used by its operators to connect with prospective clients and broadcast updates about the malware, showcasing a strategic use of Telegram to facilitate their cybercriminal activities. This practice is consistent with the broader trend where cybercriminals leverage Telegram as a central operational platform.
Using the Telegram bot API to make data exfiltration stealthy. And where does all this stolen data go? Right back to the cybercriminals via a bot, no human interaction needed.
| Deployment | Angry Stealer distributed on Telegram and other online platforms as a 32-bit Win32 executable written in .NET. |
| Data Exfiltration | Targets and exfiltrates sensitive data such as browser data, cryptocurrency wallets, VPN credentials, and system information using Telegram for data exfiltration. Data is zipped and uploaded bypassing SSL validation. |
| Relation | Shares identical code, behavior, and functionality with “Rage Stealer,” indicating a direct evolution to enhance its stealth and efficacy. |
| Distribución | Marketed on various online platforms, including websites and Telegram channels, as a tool for illicit data theft. |
| Indicators | The usage of the Russian language in the manifest file’s comments suggests possible Russian-speaking authors. |
| Payloads | Includes “MotherRussia.exe,” also known as “RDP Accessor V4,” a builder tool for creating malicious executables related to remote desktop operations and bot interactions. |
| Recommendations | Poses a significant threat due to comprehensive data-stealing capabilities. Organizations should implement measures to detect and prevent data exfiltration. |
Now, let’s discuss defense. Updated software and complex passwords are necessary, but these are just the basics. In today’s world, where your digital footprint is detailed, vigilance is needed. Organizations are encouraged to implement robust API security measures to combat this threat. Why? Because Angry Stealer exploits API drift, where the API’s actual behavior diverges from its expected behavior, opening vulnerabilities.
Looking ahead, the future seems ripe for these types of stealthy, social media-integrated malware attacks. They blend into our digital lives. Expect malware authors to continue this trend, tweaking their software to stay ahead of security measures. It’s a game, but the stakes are our personal and financial data.
Virus de extensión SwiftSeek Chrome
Nuestros investigadores encontraron recientemente SwiftSeek, una extensión del navegador encontrada en un instalador promocionado por una página web engañosa durante una verificación de rutina de sitios sospechosos. Browser hijackers like SwiftSeek change…
Virus de voz (.la voz del archivo) Secuestro de datos
El virus Hlas es un nuevo miembro de la familia de ransomware STOP/Djvu dirigido a PC con Windows. Provoca una interrupción significativa al cifrar archivos y agregar un “.Voz” extension to their…
But there’s a broader implication here. As malware like Angry Stealer becomes more common, the line between cybercrime and everyday software tools becomes blurred. Today, it’s a Telegram bot; tomorrow, it could be another popular app that turns into a data-stealing weapon. This raises questions about the security of our everyday digital tools and the privacy we often take for granted.
We’re not just users anymore; we’re targets in an evolving war against cybercrime. The tools we use to connect, share, and manage our lives are the same tools that cybercriminals exploit to undermine our security. What can we do? Stay informed, stay skeptical, and invest in cybersecurity like it’s a necessity, not just an option. Because in this digital age, the next phishing email or malicious bot could be lurking in the next app update or message you receive.
En conclusión, Angry Stealer is more than just a piece of malware; it’s a signpost for the future of cyber threats—a world where our everyday technologies are the weapons used against us. It’s a call to arms for stronger, smarter cybersecurity measures and a reminder that in the digital world, vigilance is the price of safety. Let’s not wait to be victims. Instead, let’s armor up and protect the digital frontiers we call home.