Welcome to our
Cyber Security News Aggregator
.Cyber Tzar
provide acyber security risk management
platform; including automated penetration tests and risk assesments culminating in a "cyber risk score" out of 1,000, just like a credit score.
First slide label
Some representative placeholder content for the first slide.
Second slide label
Some representative placeholder content for the second slide.
Third slide label
Some representative placeholder content for the third slide.
2024-08-23 ANGRY STEALER (Rage stealer variant) Telegram rat . Samples
published on 2024-09-02 16:54:00 UTC by MilaContent:
2024-08-23 Cyfirma. A Comprehensive Analysis of Angry Stealer : Rage Stealer in a New Disguise (Telegram rat).
CYFIRMA analyzed malware known as "Angry Stealer", which is heavily advertised on platforms like Telegram, a repackaged version of the previously identified "Rage Stealer"- The dropper is a 32-bit Win32 executable written in .NET, which acts as the initial stage of the attack. Upon execution, it deploys two key payloads: "Stepasha.exe" and "MotherRussia.exe,
- Stepasha.exe - The Info-Stealer:
- Once deployed, "Stepasha.exe" begins an extensive data collection process. It targets sensitive information stored on the infected system, including browser data (passwords, cookies, autofill data), cryptocurrency wallets, VPN credentials, and system information.
- The collected data is then packaged into a ZIP file and exfiltrated to a remote Telegram channel. This process leverages hardcoded credentials and bypasses SSL validation, ensuring the data reaches the attacker without interruption.
- The malware incorporates techniques to avoid detection, such as tampering with file timestamps and ensuring only one instance runs at a time.
- MotherRussia.exe - The Builder Tool:
- This secondary payload acts as a builder, allowing the creation of additional malicious executables. The user provides specific inputs, such as bot tokens and chat IDs, which are then embedded into the generated executable.
- The tool is likely designed for tasks related to remote desktop operations or bot interactions, making it easier for attackers to automate and scale their malicious activities.
- Angry Stealer" is a direct descendant of "Rage Stealer," sharing the same codebase and functionality. This rebranding approach allows cybercriminals to market the same malware under different names, reaching new buyers and avoiding detection by reusing proven tactics.
- The dropper was compiled in a .NET environment, likely within an isolated setup like Windows Defender Application Guard, suggesting that the developers took precautions to avoid detection during development.
Download
File Information
ae25ed76f7aa901495537c2600bf149f6a56a42f28dc8fc9c6ed6c802ce0422e_MotherRussia.exe_
bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d_Stepasha.exe_
c477b037e8fe3ab68b4c1da6f9bfe01e9ea818a5b4f94ed9e2757e25035be06d exe_
https://contagiodump.blogspot.com/2024/09/2024-08-23-angry-stealer-rage-stealer.html
Published: 2024 09 02 16:54:00
Received: 2024 09 02 17:47:21
Feed: contagio
Source: contagio
Category: Cyber Security
Topic: Cyber Security
Views: 2
