Agniane Stealer Concentrating on Customers to Steal Monetary Knowledge

Menace actors use stealers to gather delicate data from unsuspecting customers covertly.

These instruments are favored for his or her means to infiltrate methods, stay undetected, and extract useful knowledge, which menace actors can exploit for monetary achieve and a number of other malicious functions.

Stealers supply a low-risk and high-reward methodology for menace actors to entry useful belongings with out a direct combat.

Cybersecurity researchers at Cisco just lately found and warned of Agniane stealer attacking customers to steal monetary knowledge.

Agniane Stealer Attacking Customers

Agniane Stealer is a crypto-targeting malware that surged in August 2023. Researchers just lately uncovered new insights into its URL sample, file assortment strategies, and C2 protocol.

The malware was actively marketed on Telegram (@agnianebot) and makes use of ConfuserEx Protector with a singular C2 methodology.

In November 2023, researchers’ menace searching revealed passbook.bat.exe, a named PowerShell binary linked to Agniane Stealer.

Infections begin with ZIP downloads from legit web sites, following this URL sample:-

http[s]://<area identify>/book_[A-Z0-9]+-d+.zip 

Extracted recordsdata drop passbook.bat with obfuscated payload by spawning passbook.bat.exe. This renamed PowerShell binary executes a sequence of obfuscated instructions.

Then, it dynamically builds and invokes an XORing payload from a BAT file by decompressing and loading it into reminiscence reflectively. 

Apart from this, reversing the payload helps in getting the aims of the menace actors.

The payload triggers a C# meeting that ends in an executable with hash 5640c02b6d125d4e14e19709296b29b8ea34fe416e18b3d227bd79310d54b8df. 

The file was unknown to on-line sandboxes, and emulating its exercise on Cisco Safe Malware Analytics revealed anti-sandbox methods. 

Nonetheless, the binary, which was obfuscated with ConfuserEx, restricts the dynamic evaluation.

The pattern lacked a ConfuserEx signature however had related obfuscation. On reversing, one other binary that emerged in its sources was loaded reflectively. 

This C# pattern held the ultimate payload, which was obfuscated straight with ConfuserEx.

The Passbook.bat.exe executes PowerShell to deobfuscate passbook.bat, then runs the tmp385C.tmp (header file identify). This, in flip, reflectively masses the _CASH_78 C# app, which concludes with the Agniane Stealer.

The Agniane Stealer steals credentials and recordsdata through a primary C2 protocol. It checks area availability by requesting a selected URL and provides lively C2 domains to an inventory. Then, it gathers file extensions from a C2 URL sample.

Afterward, it requests a distant json file for error particulars and progresses primarily based on the response.

The stealer employed many obfuscation and anti-detection strategies to gather and exfiltrate recordsdata, credentials, passwords, bank cards, and wallets.

Furthermore, its evasion ways and broad knowledge focusing on might lure extra menace actors to use its capabilities sooner or later.

IoCs

Keep up to date on Cybersecurity information, Whitepapers, and Infographics. Comply with us on LinkedIn & Twitter.