{"id":91767,"date":"2023-07-03T12:53:40","date_gmt":"2023-07-03T07:23:40","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=91767"},"modified":"2023-07-03T16:10:29","modified_gmt":"2023-07-03T10:40:29","slug":"white-snake-menace-the-growing-threat-of-information-stealers-in-the-cybercrime-landscape","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/white-snake-menace-the-growing-threat-of-information-stealers-in-the-cybercrime-landscape\/","title":{"rendered":"White Snake Menace: The Growing Threat of Information Stealers in the Cybercrime Landscape"},"content":{"rendered":"<h2>Introduction<\/h2>\n<p>The rise of malicious software designed to steal sensitive information has become a significant problem in the cybercrime landscape. They are specifically created to infiltrate computer systems and extract valuable data, including personal information, login credentials, financial details, and intellectual property. Known as information stealers or data stealers, these malware programs pose a prevalent threat.<\/p>\n<p>Cybercriminals use various tactics to distribute information stealers, and once installed on a victim&#8217;s device, these malware programs operate discreetly, often evading detection by security software. Information stealers target a wide range of applications, including web browsers, email clients, instant messaging platforms, and financial software.<\/p>\n<p>The stolen data is usually sold on underground marketplaces or used for illegal activities like identity theft, financial fraud, corporate espionage, or blackmail. The financial motivation behind information stealers, combined with their ability to collect sensitive data from numerous victims, makes them appealing to cybercriminals.<\/p>\n<p>In <a href=\"https:\/\/blog.cyble.com\/2023\/02\/24\/new-whitesnake-stealer-offered-for-sale-via-maas-model\/\">February 2023<\/a>, a new information stealer called White Snake emerged, joining the list of threats in this category. In this blog we have delved into the technical aspects of the updated White snake stealer version 1.6, to provide insights into its behaviour and shed light on its latest capabilities.<\/p>\n<h3>The White Snake Stealer<\/h3>\n<p>\u200b\u200bFocused on infiltrating diverse applications such as cryptocurrency wallets, FTP clients, and email clients among others, White Snake exhibits a range of capabilities. These include\u00a0 execution of commands on the victim&#8217;s system enabling activities like taking screenshots and capturing webcam. Having undergone continuous development since its initial arrival, it has prompted Telegram announcements that suggest the addition of new capabilities.<\/p>\n<p>Samples showcasing these enhanced features on public repositories strongly suggests the active distribution of new versions of the White Snake stealer in the Cybercrime scene.<\/p>\n<p>White Snake Stealer offers versions for both Windows and Linux systems. However, we have not been able to find any samples specifically targeting Linux systems while others aimed at Windows platforms were identified, demonstrating advanced features.<\/p>\n<figure id=\"attachment_91769\" aria-describedby=\"caption-attachment-91769\" style=\"width: 540px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91769 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic1-540x390.png\" alt=\"\" width=\"540\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic1-540x390.png 540w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic1-300x217.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic1-150x108.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic1.png 601w\" sizes=\"(max-width: 540px) 100vw, 540px\" \/><figcaption id=\"caption-attachment-91769\" class=\"wp-caption-text\"><em>Posts announcing White Snake Stealer Updates<\/em><\/figcaption><\/figure>\n<h3><strong><b>Changes to Note in the Updated Version of White Snake Stealer<\/b><\/strong><\/h3>\n<p>White Snake Stealer has undergone significant improvements, introducing the following key features:<\/p>\n<ul>\n<li><b><\/b><strong><b>Expanded Browser Support:<\/b><\/strong>Now compatible with a wider range of browsers, including Opera, CocCoc, CentBrowser, and Yandex, allowing it to extract sensitive data from a broader user base.<\/li>\n<li><b><\/b><strong><b>Extended Email Client Compatibility:<\/b><\/strong>It can now support popular email clients like Outlook, Foxmail, and &#8216;The BAT!,\u2019 enabling the collection of data from these applications and expanding its reach.<\/li>\n<li><b><\/b><strong><b>2FA App and VPN Targeting:<\/b><\/strong>It is capable of targeting and extracting information from 2FA (Two-Factor Authentication) apps and VPN (Virtual Private Network) applications, posing a threat to user security and privacy.<\/li>\n<li><b><\/b><strong><b>Enhanced Capabilities:<\/b><\/strong>Advanced features such as keylogging, webcam capture, and document grabbing have been incorporated, which allows it to easily compromise user data by recording keystrokes, capturing webcam footage, and collecting specific document types.<\/li>\n<li><b><\/b><strong><b>Beacon Functionality:<\/b><\/strong>It can now establish communication with the command and control (C2) server allowing the receipt of instructions, transmission of stolen data, and potential downloading of additional malicious payloads.<\/li>\n<li><b><\/b><strong><b>Document Grabber<\/b><\/strong>: Can now collect and exfiltrate files of interest from the victim&#8217;s machine.<\/li>\n<li><b><\/b><strong><b>USB Spread:<\/b><\/strong>Is able to spread through USB devices by making copies on removable drives such as USB flash drives and external hard drives.<\/li>\n<li><b><\/b><strong><b>Local User Spread:<\/b><\/strong>Is also able to propagate among local users by copying itself to their startup folders, ensuring automatic execution upon user login or system restart and facilitating its spread within the compromised system.<\/li>\n<\/ul>\n<p>These noteworthy enhancements in White Snake Stealer highlights its dynamic evolution and adaptability, posing a significant threat to user privacy and security.<strong><b>\u00a0<\/b><\/strong><\/p>\n<h3><strong><b>Technical Analysis of the White Snake Stealer<\/b><\/strong><\/h3>\n<p>The malware incorporates advanced string of obfuscation techniques which is used to deliberately obscure the code. This results in increased complexity and makes it challenging to decipher the underlying strings.<\/p>\n<figure id=\"attachment_91770\" aria-describedby=\"caption-attachment-91770\" style=\"width: 531px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91770 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic2.png\" alt=\"\" width=\"531\" height=\"249\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic2.png 531w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic2-300x141.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic2-150x70.png 150w\" sizes=\"(max-width: 531px) 100vw, 531px\" \/><figcaption id=\"caption-attachment-91770\" class=\"wp-caption-text\"><em>String Obfuscation Detected<\/em><\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91771\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic3.png\" alt=\"\" width=\"598\" height=\"261\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic3.png 598w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic3-300x131.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic3-150x65.png 150w\" sizes=\"(max-width: 598px) 100vw, 598px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91772 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic4.png\" alt=\"\" width=\"560\" height=\"191\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic4.png 560w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic4-300x102.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic4-150x51.png 150w\" sizes=\"(max-width: 560px) 100vw, 560px\" \/><\/p>\n<p>The figure above shows the method responsible for deobfuscating strings within the stealer&#8217;s codebase. Its widespread usage adds complexity to the analysis process. Additionally, the deliberate incorporation of redundant codes within the stealer adds further layers of complexity. These intentional obfuscation techniques make the analysis of the stealer even more intricate.<\/p>\n<figure id=\"attachment_91773\" aria-describedby=\"caption-attachment-91773\" style=\"width: 505px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91773 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic5-505x390.png\" alt=\"\" width=\"505\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic5-505x390.png 505w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic5-300x232.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic5-150x116.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic5.png 602w\" sizes=\"(max-width: 505px) 100vw, 505px\" \/><figcaption id=\"caption-attachment-91773\" class=\"wp-caption-text\"><em>Garbage Code<\/em><\/figcaption><\/figure>\n<h3><strong><b>Anti Virtual Machines (VM) Checks<\/b><\/strong><\/h3>\n<p>During the execution of the stealer&#8217;s main () method, the Anti VM method is invoked to prevent the malware from running in a virtual environment. This function employs Windows Management Instrumentation (WMI) queries to retrieve the system&#8217;s &#8220;Manufacturer&#8221; and &#8220;Model&#8221; information. Subsequently, it compares these details with predefined strings associated with VMs. If a match is detected, the malware terminates without proceeding with any further execution.<\/p>\n<figure id=\"attachment_91774\" aria-describedby=\"caption-attachment-91774\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91774 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic6.png\" alt=\"\" width=\"602\" height=\"158\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic6.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic6-300x79.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic6-150x39.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91774\" class=\"wp-caption-text\"><em>WMI Queries to Extract the Environment Information<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91775\" aria-describedby=\"caption-attachment-91775\" style=\"width: 567px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91775 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic7-567x390.png\" alt=\"\" width=\"567\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic7-567x390.png 567w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic7-300x206.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic7-229x158.png 229w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic7-150x103.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic7.png 602w\" sizes=\"(max-width: 567px) 100vw, 567px\" \/><figcaption id=\"caption-attachment-91775\" class=\"wp-caption-text\"><em>Hardcoded Strings<\/em><\/figcaption><\/figure>\n<h3><strong><b>Establishing Persistence <\/b><\/strong><\/h3>\n<p>The stealer achieves persistence by duplicating itself in the Appdata directory and creating a scheduled task. Subsequently, it removes the original file to cover its tracks. Different versions are observed to be creating different directories.<\/p>\n<p>Fig. Below shows the stealer creating a directory with the name \u201cEsetSecurity.\u201d Directory names may vary across different variants. It copies itself in this newly created directory.<\/p>\n<figure id=\"attachment_91776\" aria-describedby=\"caption-attachment-91776\" style=\"width: 572px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91776 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic8.png\" alt=\"\" width=\"572\" height=\"49\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic8.png 572w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic8-300x26.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic8-150x13.png 150w\" sizes=\"(max-width: 572px) 100vw, 572px\" \/><figcaption id=\"caption-attachment-91776\" class=\"wp-caption-text\"><em>Observed to be creating a director with &#8220;EsetSecurity&#8221; name<\/em><\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91777\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic9.png\" alt=\"\" width=\"602\" height=\"303\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic9.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic9-300x151.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic9-150x75.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<figure id=\"attachment_91778\" aria-describedby=\"caption-attachment-91778\" style=\"width: 531px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91778 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic10-531x390.png\" alt=\"\" width=\"531\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic10-531x390.png 531w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic10-300x220.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic10-150x110.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic10.png 602w\" sizes=\"(max-width: 531px) 100vw, 531px\" \/><figcaption id=\"caption-attachment-91778\" class=\"wp-caption-text\"><em>Stealer code for persistence, creating schedule task and deleting itself<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91818\" aria-describedby=\"caption-attachment-91818\" style=\"width: 579px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91818 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image.jpg\" alt=\"\" width=\"579\" height=\"147\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image.jpg 579w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-300x76.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-150x38.jpg 150w\" sizes=\"(max-width: 579px) 100vw, 579px\" \/><figcaption id=\"caption-attachment-91818\" class=\"wp-caption-text\"><em>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0Creating a Scheduled Task<\/em><\/figcaption><\/figure>\n<h3><strong><b>New Beacon Functionality<\/b><\/strong><\/h3>\n<p>The latest version of the stealer introduces a new beacon feature that leverages The Onion Routing Project (TOR) for its implementation. This enhanced functionality enhances the capabilities of the stealer and involves the following key components:<\/p>\n<ul>\n<li><b><\/b><strong><b>TOR Download and Installation:<\/b><\/strong>The stealer now has the ability to download and install TOR, a network tool that enables anonymous communication on the internet.<\/li>\n<li><b><\/b><strong><b>Tailored TOR Service Configuration:<\/b><\/strong>The malware utilizes the &#8220;HiddenServicePort 80 127.0.0.1:2392&#8221; configuration directive in the TOR configuration file to set up a hidden TOR service. This directive specifies that incoming requests to the hidden service on port 80 will be redirected to a randomly generated port (2392) on the local machine. The malware specifically utilizes this redirected port to run an HTTPListener service responsible for handling the incoming requests.<\/li>\n<li><b><\/b><strong><b>Connection Establishment<\/b><\/strong>: The beacon functionality is implemented by establishing a connection between TOR and an open port on the victim&#8217;s system. The onion address, which serves as the unique identifier for the hidden service, is generated and stored in a file within the directory specified by the &#8220;HiddenServiceDir&#8221; configuration directive in the TOR configuration file. The attacker or Threat Actor (TA) connects to the hidden service using this onion address through the TOR network.<\/li>\n<\/ul>\n<p>Through this communication channel facilitated by the HTTPListener(), the attacker can issue commands or exfiltrate stolen data from the victim&#8217;s machine. The attacker&#8217;s commands or requests are sent through the TOR network, reaching the hidden service configured on port 80, and subsequently forwarded to the local machine&#8217;s port 2392. The HTTPListener service of the stealer processes and responds to these requests.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91779 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic11.png\" alt=\"\" width=\"600\" height=\"376\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic11.png 600w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic11-300x188.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic11-150x94.png 150w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/p>\n<figure id=\"attachment_91780\" aria-describedby=\"caption-attachment-91780\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91780 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic12.png\" alt=\"\" width=\"602\" height=\"335\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic12.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic12-300x167.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic12-150x83.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91780\" class=\"wp-caption-text\"><em>Tailored TOR configuration in the malware code<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91781\" aria-describedby=\"caption-attachment-91781\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91781 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic13.png\" alt=\"\" width=\"602\" height=\"112\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic13.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic13-300x56.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic13-150x28.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91781\" class=\"wp-caption-text\"><em>TORRC (TOR configuration) file created by stealer<\/em><\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91782 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic14.png\" alt=\"\" width=\"544\" height=\"49\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic14.png 544w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic14-300x27.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic14-150x14.png 150w\" sizes=\"(max-width: 544px) 100vw, 544px\" \/><\/p>\n<figure id=\"attachment_91783\" aria-describedby=\"caption-attachment-91783\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91783 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic15.png\" alt=\"\" width=\"602\" height=\"165\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic15.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic15-300x82.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic15-304x84.png 304w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic15-150x41.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91783\" class=\"wp-caption-text\"><em>Onion address<\/em><\/figcaption><\/figure>\n<p>Once a connection request is received from the TA, the stealer enters the processing phase. During this phase, it actively scans for incoming HTTP requests that utilize the POST method. The POST method is commonly used to send data to a web server, including commands or instructions in the payload of the request.<\/p>\n<p>Upon detecting an incoming POST request, the stealer extracts and isolates the payload, which contains the commands encapsulated within the request. These commands may include instructions for various actions the stealer is designed to perform, such as collecting sensitive data, executing specific operations on the victim&#8217;s machine, or initiating further malicious activities.<\/p>\n<p>By identifying and extracting the commands from the POST requests, the stealer gains access to the TA&#8217;s instructions and can proceed to execute them accordingly. This allows the TA to remotely control the stealer&#8217;s behaviour and carry out specific actions on the compromised system.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91784 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic16-535x390.png\" alt=\"\" width=\"535\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic16-535x390.png 535w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic16-300x219.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic16-150x109.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic16.png 602w\" sizes=\"(max-width: 535px) 100vw, 535px\" \/><\/p>\n<figure id=\"attachment_91785\" aria-describedby=\"caption-attachment-91785\" style=\"width: 342px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91785 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic17.png\" alt=\"\" width=\"342\" height=\"32\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic17.png 342w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic17-300x28.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic17-150x14.png 150w\" sizes=\"(max-width: 342px) 100vw, 342px\" \/><figcaption id=\"caption-attachment-91785\" class=\"wp-caption-text\"><em>Processing the incoming request<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91786\" aria-describedby=\"caption-attachment-91786\" style=\"width: 466px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91786 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic18.png\" alt=\"\" width=\"466\" height=\"21\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic18.png 466w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic18-300x14.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic18-150x7.png 150w\" sizes=\"(max-width: 466px) 100vw, 466px\" \/><figcaption id=\"caption-attachment-91786\" class=\"wp-caption-text\"><em>Extracting the commands<\/em><\/figcaption><\/figure>\n<p>Subsequently, once the TA\u2019s commands have been extracted from the incoming HTTP requests, the stealer proceeds with its processing. The processing phase involves interpreting and executing the commands as instructed by the TA.<\/p>\n<figure id=\"attachment_91788\" aria-describedby=\"caption-attachment-91788\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91788 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic20.png\" alt=\"\" width=\"602\" height=\"314\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic20.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic20-300x156.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic20-150x78.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91788\" class=\"wp-caption-text\"><em>Further Processing of Commands<\/em><\/figcaption><\/figure>\n<p>The updated version of the stealer includes an expanded set of command capabilities, allowing it to perform the following actions:<\/p>\n<ul>\n<li>REFRESH: Transmits the stolen data back to the attacker.<\/li>\n<li>COMPRESS: Compresses a file with TAR.<\/li>\n<li>PING: Performs a &#8216;ping&#8217; like operation and responds with a &#8216;pong&#8217;.<\/li>\n<li>UNINSTALL: Terminates and removes itself from the system.<\/li>\n<li>WEBCAM: Captures webcam footage<\/li>\n<li>LIST_PROCESSES: Retrieves a list of all running processes.<\/li>\n<li>GET_FILE: Retrieves the contents of a specific file.<\/li>\n<li>SCREENSHOT: Captures a screenshot of the victim&#8217;s screen.<\/li>\n<li>LIST_FILES: Lists files in the current directory.<\/li>\n<li>TRANSFER: Transfers a file to the attacker&#8217;s server.<\/li>\n<li>LOADEXEC: Downloads a file from remote location and executes it.<\/li>\n<li>DECOMPRESS: Decompresses a file with TAR for transfer.<\/li>\n<li>DPAPI: Decrypts the encryption protection applied to sensitive data stored on the victim&#8217;s system.<\/li>\n<li>Keylogger: Capture keystroke<\/li>\n<\/ul>\n<figure id=\"attachment_91789\" aria-describedby=\"caption-attachment-91789\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91789 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic21.png\" alt=\"\" width=\"602\" height=\"299\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic21.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic21-300x149.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic21-150x75.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91789\" class=\"wp-caption-text\">Keylogging using &#8216;hookCallback&#8217; for monitoring of keystrokes<\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91790\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic22.png\" alt=\"\" width=\"602\" height=\"230\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic22.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic22-300x115.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic22-150x57.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<figure id=\"attachment_91791\" aria-describedby=\"caption-attachment-91791\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91791 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic23.png\" alt=\"\" width=\"602\" height=\"122\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic23.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic23-300x61.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic23-150x30.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91791\" class=\"wp-caption-text\"><em>Screenshot Capability<\/em><\/figcaption><\/figure>\n<h3><strong><b>USB Spread <\/b><\/strong><\/h3>\n<p>The stealer has incorporated a USB spread capability, enabling it to propagate itself to removable disks. It achieves this by querying the system for removable disks and subsequently copying itself onto the identified media.<\/p>\n<figure id=\"attachment_91792\" aria-describedby=\"caption-attachment-91792\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91792 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic24.png\" alt=\"\" width=\"602\" height=\"388\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic24.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic24-300x193.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic24-150x97.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91792\" class=\"wp-caption-text\"><em>Queries removable media<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91793\" aria-describedby=\"caption-attachment-91793\" style=\"width: 422px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91793 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic25.png\" alt=\"\" width=\"422\" height=\"61\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic25.png 422w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic25-300x43.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic25-150x22.png 150w\" sizes=\"(max-width: 422px) 100vw, 422px\" \/><figcaption id=\"caption-attachment-91793\" class=\"wp-caption-text\"><em>Copies itself on removable media<\/em><\/figcaption><\/figure>\n<h3><strong><b>Local Users Spread<\/b><\/strong><\/h3>\n<p>The updated stealer now includes a Local User Spread capability, allowing it to propagate among local users. The malware achieves this by iterating over user profiles and copying itself to the startup folder of each user. This ensures that the malware is automatically executed when users log in or the system restarts. By leveraging this persistence mechanism, the malware can effectively spread among local users, resulting in its widespread presence throughout the compromised system.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91794\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Pic26.png\" alt=\"\" width=\"602\" height=\"107\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic26.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic26-300x53.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Pic26-150x27.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<figure id=\"attachment_91795\" aria-describedby=\"caption-attachment-91795\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91795 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture27.png\" alt=\"\" width=\"602\" height=\"95\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture27.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture27-300x47.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture27-150x24.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91795\" class=\"wp-caption-text\"><em>Iterating over management objects<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91796\" aria-describedby=\"caption-attachment-91796\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91796 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture28.png\" alt=\"\" width=\"602\" height=\"91\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture28.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture28-300x45.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture28-150x23.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91796\" class=\"wp-caption-text\"><em>Copies itself to startup folder<\/em><\/figcaption><\/figure>\n<h3><strong><b>Application Data Collection<\/b><\/strong><\/h3>\n<p>The malware exhibits the capability to extract sensitive information from various types of applications:<\/p>\n<figure id=\"attachment_91819\" aria-describedby=\"caption-attachment-91819\" style=\"width: 342px\" class=\"wp-caption alignleft\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91819\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-1-330x390.jpg\" alt=\"\" width=\"342\" height=\"404\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-1-330x390.jpg 330w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-1-254x300.jpg 254w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-1-150x177.jpg 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/MicrosoftTeams-image-1.jpg 691w\" sizes=\"(max-width: 342px) 100vw, 342px\" \/><figcaption id=\"caption-attachment-91819\" class=\"wp-caption-text\"><em>Targeted Applications<\/em><\/figcaption><\/figure>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<figure id=\"attachment_91797\" aria-describedby=\"caption-attachment-91797\" style=\"width: 567px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91797 size-large\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture29-567x390.png\" alt=\"\" width=\"567\" height=\"390\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture29-567x390.png 567w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture29-300x206.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture29-229x158.png 229w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture29-150x103.png 150w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture29.png 602w\" sizes=\"(max-width: 567px) 100vw, 567px\" \/><figcaption id=\"caption-attachment-91797\" class=\"wp-caption-text\"><em>Stealer configuration with reference to various application for information stealing<\/em><\/figcaption><\/figure>\n<p>Furthermore, the malware possesses the capability to gather additional information from the victim&#8217;s system. This includes retrieving the username, computer name, public IP address, screen size, CPU, GPU, RAM, Disk, Model, OS information, running process and execution timestamp. These data points provide the attacker with valuable insights into the victim&#8217;s system and can be used for further analysis or exploitation.<\/p>\n<figure id=\"attachment_91798\" aria-describedby=\"caption-attachment-91798\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91798 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture30.png\" alt=\"\" width=\"602\" height=\"108\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture30.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture30-300x54.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture30-150x27.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91798\" class=\"wp-caption-text\"><em>Extracting username<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91799\" aria-describedby=\"caption-attachment-91799\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91799 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture31.png\" alt=\"\" width=\"602\" height=\"73\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture31.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture31-300x36.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture31-150x18.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91799\" class=\"wp-caption-text\"><em>Extracting computer name<\/em><\/figcaption><\/figure>\n<h3><strong><b>Exfiltration<\/b><\/strong><\/h3>\n<p>Once the data is gathered, the malware employs the XmlSerializer to transform it into a serialized format. Subsequently, the serialized data undergoes compression and encryption using the RSA encryption algorithm. This multi-step process ensures the secure protection of the data, preserving its integrity and maintaining confidentiality. It is worth noting that the malware embeds the RSA key necessary for encryption within its own code.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91800\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture32.png\" alt=\"\" width=\"602\" height=\"22\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture32.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture32-300x11.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture32-150x5.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91801\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture33.png\" alt=\"\" width=\"602\" height=\"68\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture33.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture33-300x34.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture33-150x17.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91802\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture34.png\" alt=\"\" width=\"602\" height=\"42\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture34.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture34-300x21.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture34-150x10.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<figure id=\"attachment_91803\" aria-describedby=\"caption-attachment-91803\" style=\"width: 357px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91803 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture35.png\" alt=\"\" width=\"357\" height=\"30\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture35.png 357w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture35-300x25.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture35-150x13.png 150w\" sizes=\"(max-width: 357px) 100vw, 357px\" \/><figcaption id=\"caption-attachment-91803\" class=\"wp-caption-text\"><em>Captured data being serialized into XML format<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91804\" aria-describedby=\"caption-attachment-91804\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91804 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture36.png\" alt=\"\" width=\"602\" height=\"48\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture36.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture36-300x24.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture36-150x12.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91804\" class=\"wp-caption-text\"><em>RSA Key<\/em><\/figcaption><\/figure>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91805\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture37.png\" alt=\"\" width=\"602\" height=\"57\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture37.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture37-300x28.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture37-150x14.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<figure id=\"attachment_91806\" aria-describedby=\"caption-attachment-91806\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91806 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture38.png\" alt=\"\" width=\"602\" height=\"49\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture38.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture38-300x24.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture38-150x12.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91806\" class=\"wp-caption-text\"><em>Encryption using RSA Key<\/em><\/figcaption><\/figure>\n<p>Now, the stealer will proceed to affix tags, including the filename (e.g., Username@Computername_report.wsr), to the gathered information. Subsequently, the malware establishes a connection to a predetermined server controlled by the attacker using the WebClient class&#8217;s \u2018uploadData\u2019 method with the PUT HTTP method. The malware code includes hardcoded IP addresses that specify the destination server for transmitting the encrypted data. This allows the attacker to receive the stolen information from infected systems.<\/p>\n<figure id=\"attachment_91807\" aria-describedby=\"caption-attachment-91807\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91807 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture39.png\" alt=\"\" width=\"602\" height=\"205\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture39.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture39-300x102.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture39-150x51.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91807\" class=\"wp-caption-text\"><em>WebClient Class instantiation<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91808\" aria-describedby=\"caption-attachment-91808\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91808 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture40.png\" alt=\"\" width=\"602\" height=\"365\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture40.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture40-300x182.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture40-150x91.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91808\" class=\"wp-caption-text\"><em>Obfuscated code used to send the PUT request for data exfil<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91809\" aria-describedby=\"caption-attachment-91809\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91809 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture41.png\" alt=\"\" width=\"602\" height=\"284\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture41.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture41-300x142.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture41-150x71.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91809\" class=\"wp-caption-text\"><em>Hardcoded IP addresses of the attacker&#8217;s server<\/em><\/figcaption><\/figure>\n<figure id=\"attachment_91810\" aria-describedby=\"caption-attachment-91810\" style=\"width: 601px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91810 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture42.png\" alt=\"\" width=\"601\" height=\"263\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture42.png 601w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture42-300x131.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture42-150x66.png 150w\" sizes=\"(max-width: 601px) 100vw, 601px\" \/><figcaption id=\"caption-attachment-91810\" class=\"wp-caption-text\"><em>PUT request issued for data exfil<\/em><\/figcaption><\/figure>\n<p>To notify attacker about the data exfiltration, the malware sends a notification through a Telegram chat by executing an HTTP GET request to the Telegram BOT API.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-91811\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture43.png\" alt=\"\" width=\"602\" height=\"54\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture43.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture43-300x27.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture43-150x13.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/p>\n<p>The contents of the URL are encoded with URL encoding. Decoding the Telegram message reveals valuable resources for the attacker: the stolen data&#8217;s URL and victim details. This allows the attacker to directly access and exploit the information for malicious purposes, increasing their effectiveness in carrying out harmful activities.<\/p>\n<figure id=\"attachment_91812\" aria-describedby=\"caption-attachment-91812\" style=\"width: 602px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-91812 size-full\" src=\"https:\/\/blogs.quickheal.com\/wp-content\/uploads\/2023\/07\/Picture44.png\" alt=\"\" width=\"602\" height=\"108\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture44.png 602w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture44-300x54.png 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2023\/07\/Picture44-150x27.png 150w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><figcaption id=\"caption-attachment-91812\" class=\"wp-caption-text\"><em>URL decoded contents<\/em><\/figcaption><\/figure>\n<h3><strong><b>Quick Heal Protection <\/b><\/strong><\/h3>\n<p>All Quick Heal customers are protected against this threat through the following signature:<\/p>\n<ul>\n<li>Trojan.WhiteSnake.S30222827<\/li>\n<\/ul>\n<p><strong>To know more about Quick Heal\u2019s range of digital protection visit &#8211;\u00a0<\/strong><\/p>\n<p><a href=\"https:\/\/www.quickheal.com\/\">https:\/\/www.quickheal.com\/<\/a><\/p>\n<h2><strong><b>Conclusion<\/b><\/strong><\/h2>\n<p>The White Snake Stealer is an evolving threat that is being actively developed and distributed through the Malware-as-a-Service (MaaS) model. The threat actors responsible for this stealer is dedicated to improving the code and implementing techniques to bypass detection measures. This ongoing development highlights the persistent and evolving nature of the threat landscape, re-emphasizing the criticality for individuals and organizations to stay updated on the latest security practices, implement robust D\u00e9fense mechanisms, and maintain strong cybersecurity hygiene to protect themselves against such threats.<\/p>\n<h3><strong><b>Indicators of Compromise (IOCs)<\/b><\/strong><\/h3>\n<table>\n<tbody>\n<tr>\n<td width=\"485\">b133fccfd54e62681e3549c6947ca1521417745cc7f376c362ba118bcc0de39b<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">b133fccfd54e62681e3549c6947ca1521417745cc7f376c362ba118bcc0de39b<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">e76e206e8ae24f95a329b4f6ecdf1f22b76b07a8c628c0619b781bdba2d85732<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">bc7536cb39c4dc0ef7522b46efbc97b87edd958248267932c46cdda2d571a72b<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">18b27eb6ec1898c6a8422e43e386f901eca8f09949eb63229d53f5041e5d2910<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">0d5996e68d654bb1ab31c89ae0a5b3c810f9f761f20df825d4ab5bba3d510bde<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">c219beaecc91df9265574eea6e9d866c224549b7f41cdda7e85015f4ae99b7c7<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">b133fccfd54e62681e3549c6947ca1521417745cc7f376c362ba118bcc0de39b<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">e76e206e8ae24f95a329b4f6ecdf1f22b76b07a8c628c0619b781bdba2d85732<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">138a262303b34cf0da63a5a8d32217db66f97ef5873dbac0f51ada3659c8cb3f<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">0000028f80066ad99544cc7a79caa649ee72eca2711b1b1128df61ffd13b0657<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">f8fd7b7eabb7b70e3f5a13bf8526eb620522a3c0aac6caf05b4db83d13e1e625<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">0c6705665e94b4d7184fe34185d0ea2706c745ddb71bb45bb194c96ebe2d7869<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">df78f7993dc9aaee7666a06a6dae52ba0fc6e63e01376474fa96af360cf566de<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">a4191e00cd9dfeda78901ef9dae317e23c73408e7b4c1eeef8de6a8c70fe9db7<\/td>\n<\/tr>\n<tr>\n<td width=\"485\">b4c9d3abd4fe5b4be84884c933e8d9a6a80ce326e05432a7ecb8a7c28f393941<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Introduction The rise of malicious software designed to steal sensitive information has become a significant problem in the cybercrime landscape. They are specifically created to infiltrate computer systems and extract valuable data, including personal information, login credentials, financial details, and intellectual property. Known as information stealers or data stealers, these malware programs pose a prevalent [&hellip;]<\/p>\n","protected":false},"author":105,"featured_media":91827,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1214,289,1739,1529,1671,1],"tags":[1990,1991,1953,1930,1989,1362,1988],"class_list":["post-91767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computer-security-terms-2","category-cyber-safety","category-cybersecurity","category-data-breach","category-encryption","category-uncategorized","tag-infiltration","tag-malicioussoftware","tag-malwareattack","tag-stealers","tag-whitesnake","tag-cybercrime","tag-cyberthreats"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/91767"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/105"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=91767"}],"version-history":[{"count":13,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/91767\/revisions"}],"predecessor-version":[{"id":91829,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/91767\/revisions\/91829"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/91827"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=91767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=91767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=91767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}