SHA1:
- f321b422c4b2fc560ea87520e5720d1c12ea93f3
Description
This data theft trojan takes part in the attack that leverages bogus GitHub repositories to target blockchain game enthusiasts and information security professionals. JS.Stealer.191 steals users' personal data.
Operation
Trojan.Loader.3261 downloads the archive Nexara.7z containing yet another compressed file Nvdia.7z, whose content includes the malicious module JS.Stealer.191. The stealer runs a VM/sandbox check. Then it collects information about the infected device and its users and subsequently transmits it to the attackers via their Telegram bot. The collected data includes:
- passwords, cookie files, bookmarks, autofill data, browsing and download history, and banking data stored by browsers;
- FileZilla's XML files;
- The MobaXterm file MobaXterm.ini;
- Total Commander’s wcx_ftp.ini file;
- OpenVPN, NordVPN and ProtonVPN configuration files;
- Element, Signal, ICQ, Skype, Tox, Telegram, Pidgin files;
- Minecraft, Growtopia, Roblox, Valorant account information;
- Account information associated with such game platforms as GOG.com, Steam, Electronic Arts, Rockstar Games, Launcher, Ubisoft Connect, Battle.net, RiotGames, EpicGamesLauncher;
- Discord tokens.
In addition, JS.Stealer.191 downloads 7zip and installs it into C:\\ProgramData\\sevenZip\\7z.exe. The stolen data is compressed ($7'YI^c=bbW9Koz is the archive password) and forwarded to the Telegram bot.
MITRE ATT@CK MATRIX
| Tactic | Technique |
|---|---|
| Stealth |
Virtualization/sandbox evasion (T1497) Obfuscated files or information (T1027) |
| Credential Access |
Steal Web Session Cookie (T1539) Credentials from Web Browsers (T1555.003) |
| Discovery |
Virtualization/Sandbox Evasion (T1497) System owner/User Discovery (T1033) System Information Discovery (T1082) File and Directory Discovery (T1083) |
| Collection |
Data Staged (T1074) Data from Local System (T1005) Archive Collected Data (T1560) |
| Command and Control |
Ingress Tool Transfer (T1105) One-Way Communication (T1102.003) |
| Exfiltration | Exfiltration Over Web Service (T1567) |
More about Trojan.Loader.3261
More about Trojan.Clipper.688
