Home Tech This new malware has emerged from the dark web and is after your data

This new malware has emerged from the dark web and is after your data

by pfuwi
0 comment

Experts have warned of a new information-stealing malware has been observed circulating around the dark web as it looks to gather new customers and victims alike.

Cybersecurity researchers from SEKOIA came across multiple ads, on different underground forums and Telegram groups promoting a new infostealer called Stealc.

Apparently, Stealc is not built from scratch, but is rather an upgrade to other, more popular infostealers, such as Vidar, Racoon, Mars, and Redline Stealer, having been first spotted in January 2023 but then gaining more traction the following month.

Weekly updates

Stealc was built, and is being advertised, by a threat actor going by the name “Plymouth”. It is currently at version 1.3.0, and it seems to be getting new tweaks and upgrades at least once a week. 

Some of the newly added features include a C2 URL randomizer, and improved logs searching and sorting system. Stealc was also seen sparing people from Ukraine. 

After further analyzing a sample of the infostealer, SEKOIA uncovered that it uses legitimate third-party DLLs, that it’s written C and abuses Windows API functions, that it’s lightweight (only 80KB), that it obfuscates most of its strings with RC4 and base64, and that it exfiltrates stolen files automatically (requiring no action from the threat actor). 

SEKOIA has also found Stealc to be able to steal data from 22 web browsers, 75 plugins, and 25 desktop wallets. 

Besides advertising it on the dark web, Plymouth was also busy deploying it to target endpoints. One of the ways they do it is by creating fake YouTube tutorials on how to crack software, and providing a link in the description which, instead of the advertised crack, deploys the infostealer.

So far, more than 40 C2 servers were discovered, leading the researchers to conclude Stealc is growing quite popular. The popularity, they speculate, comes from the fact that crooks that can access the admin panel can easily generate new stealer samples, thus increasing its range. 

SEKOIA believes Stealc can become quite popular as it can be adopted by low-level hackers, as well. 

Via: BleepingComputer

You may also like

Leave a Comment

Our Company

newswebby is where tomorrow is realized. it is the essential source of information and ideas that make sense of a world in constant transformation. the newswebby conversation illuminates how technology is changing every aspect of our lives—from culture to business, science to design. the breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries.


Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Laest News

© 2023  – All Right Reserved. Newswebby