This new malware has emerged from the dark web and is after your data

Date:
Tue, 21 Feb 2023 19:58:14 +0000

Description:
Vidar malware spinoff is gaining traction fast due to the ease of use and a rich set of features.

FULL STORY ======================================================================

Experts have warned of a new information-stealing malware has been observed circulating around the dark web as it looks to gather new customers and victims alike.

Cybersecurity researchers from SEKOIA came across multiple ads, on different underground forums and Telegram groups promoting a new infostealer called Stealc.

Apparently, Stealc is not built from scratch, but is rather an upgrade to other, more popular infostealers, such as Vidar, Racoon, Mars, and Redline Stealer, having been first spotted in January 2023 but then gaining more traction the following month. Weekly updates

Stealc was built, and is being advertised, by a threat actor going by the
name Plymouth. It is currently at version 1.3.0, and it seems to be getting new tweaks and upgrades at least once a week.

Some of the newly added features include a C2 URL randomizer, and improved logs searching and sorting system. Stealc was also seen sparing people from Ukraine.

After further analyzing a sample of the infostealer, SEKOIA uncovered that it uses legitimate third-party DLLs, that its written C and abuses Windows API functions, that its lightweight (only 80KB), that it obfuscates most of its strings with RC4 and base64, and that it exfiltrates stolen files automatically (requiring no action from the threat actor).

SEKOIA has also found Stealc to be able to steal data from 22 web browsers , 75 plugins, and 25 desktop wallets. Read more

A nasty new infostealer malware is landing in email inboxes

This infostealer has a vicious sting for Python developers

Check out the best firewalls

Besides advertising it on the dark web, Plymouth was also busy deploying it
to target endpoints . One of the ways they do it is by creating fake YouTube tutorials on how to crack software, and providing a link in the description which, instead of the advertised crack, deploys the infostealer.

So far, more than 40 C2 servers were discovered, leading the researchers to conclude Stealc is growing quite popular. The popularity, they speculate, comes from the fact that crooks that can access the admin panel can easily generate new stealer samples, thus increasing its range.

SEKOIA believes Stealc can become quite popular as it can be adopted by low-level hackers, as well. Remove malware with these solutions

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/this-new-malware-has-emerged-from-the-dark-web- and-is-after-your-data


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)