ACCE Release Notes v2.6.20240801

This release consists of the following:

  • XWorm V5.6 variant
  • Mint malware
  • RedRose Crypter
  • xorto Stealer
  • Duvet Stealer
  • Try Stealer
  • Update Waltuhium Stealer to identify the derivative work Hellion KeyLogger
  • Hawkish-Eyes Grabber
  • GrMsk variant (referred to as Acrid Stealer by Kaspersky)
  • Scarlet Stealer
  • EAZfuscator obfuscated version of DcRat
  • Obj3ctivity malware (Downloader and Stealer), which are obfuscated using UnseeSharp
  • Shiraza Crypter (CT named malware)
  • AgentMask Crypter
  • ShellcodeEncryptor Injector
  • Roosevelt Clipper
  • EclipseRAT
  • Hex and Base64 encoded variants of Poseidon Loader
  • DBatLoader Steganography Crypter variants
  • Hex and Base64 encoded variants of Poseidon Loader
  • Candy Grabber, and derivative Grabbers Papu, YumaClicker, and Goofed
  • Alientech Stealer
  • LERY Stealer
  • Image Stealer
  • Kematian Stealer

xorto Stealer

xorto is a stealer written in JavaScript which was posted about on X by users @suyog41 and @sarfraz432. As @sarfraz432 noted, xorto has been distributed using the Electron Packager, and is obfuscated using the open-source RedRose Crypter.

The RedRose Crypter uses scrypt to derive an AES-GCM key and decrypt the embedded JavaScript component. Using VirusTotal (VT) to identify additional RedRose Crypter samples, we found Duvet Stealer and Try Stealer (the malware’s internal name) as payloads.

Obj3ctivity Stealer

Obj3ctivity (aka PXRECVOWEIWOEI) is a .NET based Stealer which has been researched by CERT-AGID and described by X user @suyog41. The latest research by CERT-AGID introduced a downloader component to Obj3ctivity, which downloads a gzip compressed and Base64 encoded component to decode/decompress and execute in memory.

Both the downloader and Stealer components are obfuscated using the open-source UnseeSharp obfuscator, which protects strings using native code and/or base64 encoding. The obfuscator can also AES encrypt strings, but this was not observed during research. In addition to using UnseeSharp, the Obj3ctivity components decode strings using a subtraction operation, distinguishing Obj3ctivity samples from other UnseeSharp obfuscated malware.

Research into UnseeSharp led to the discovery of Shiraza Crypter (named for its namespace) and AgentMask Crypter.

Shiraza Crypter contains AES-CBC encrypted payloads in its resources, which include BlankGrabber, Obj3ctivity Downloader, WarzoneRAT, and QuasarRAT.

AgentMask Crypter contains AES-ECB encrypted component(s) in its resources, and also has an internal configuration which consists of a mutex and installation parameters (an installation path and scheduled task). Payloads for AgentMask include DcRat, XWorm, and 44 Caliber Stealer.

Projects containing the same code base as AgentMask were also identified, including Eclipse-RAT and Roosevelt Clipper. In addition to the configuration parameters in AgentMask, Eclipse-RAT contains a Telegram URL, while Roosevelt Clipper contains a Telegram URL and CryptoCurrency wallet addresses. Eclipse-RAT payloads include Phoenix Clipper, XWorm, and DcRat, while Roosevelt Clipper payloads include XWorm.

Posted in Uncategorized and tagged , .