Experts have warned of a new information-stealing malware has been observed circulating around the dark web as it looks to gather new customers and victims alike.
Cybersecurity researchers from SEKOIA came across multiple ads, on different underground forums and Telegram groups promoting a new infostealer called Stealc.
Apparently, Stealc is not built from scratch, but is rather an upgrade to other, more popular infostealers, such as Vidar, Racoon, Mars, and Redline Stealer, having been first spotted in January 2023 but then gaining more traction the following month.
Weekly updates
Stealc was built, and is being advertised, by a threat actor going by the name “Plymouth”. It is currently at version 1.3.0, and it seems to be getting new tweaks and upgrades at least once a week.
Some of the newly added features include a C2 URL randomizer, and improved logs searching and sorting system. Stealc was also seen sparing people from Ukraine.
After further analyzing a sample of the infostealer, SEKOIA uncovered that it uses legitimate third-party DLLs, that it’s written C and abuses Windows API functions, that it’s lightweight (only 80KB), that it obfuscates most of its strings with RC4 and base64, and that it exfiltrates stolen files automatically (requiring no action from the threat actor).
SEKOIA has also found Stealc to be able to steal data from 22 web browsers, 75 plugins, and 25 desktop wallets.
Besides advertising it on the dark web, Plymouth was also busy deploying it to target endpoints (opens in new tab). One of the ways they do it is by creating fake YouTube tutorials on how to crack software, and providing a link in the description which, instead of the advertised crack, deploys the infostealer.
So far, more than 40 C2 servers were discovered, leading the researchers to conclude Stealc is growing quite popular. The popularity, they speculate, comes from the fact that crooks that can access the admin panel can easily generate new stealer samples, thus increasing its range.
SEKOIA believes Stealc can become quite popular as it can be adopted by low-level hackers, as well.
Via: BleepingComputer (opens in new tab)
Source: www.techradar.com
