Most samples we have seen are about 1.5 MiB in size, however, Masad Stealer can be found in larger executables as it is sometimes bundled into other software. This malware is written using Autoit scripts and then compiled into a Windows executable. Because Masad is being sold as off-the-shelf malware, it will be deployed by multiple threat actors who may or may not be the original malware writers. Masad Stealer sends all of the information it collects – and receive commands from – a Telegram bot controlled by the threat actor deploying that instance of Masad. Masad Stealer also automatically replaces cryptocurrency wallets from the clipboard with its own.
The malware is being advertised on black market forums as “Masad Clipper and Stealer.” It steals browser data, which might contain usernames, passwords and credit card information. Using Telegram as a Command and Control (C&C) channel allows the malware some anonymity, as Telegram is a legitimate messaging application with 200 million monthly active users. Juniper Threat Labs discovered a new Trojan-delivered spyware that uses Telegram to exfiltrate stolen information.
0 kommentar(er)
