Another InfoStealer Enters the Field, ExelaStealer | FortiGuard Labs

Affected Platforms: Windows
Impacted Users: Windows users
Impact: The information collected can be used for future attacks
Severity Level: Medium

In 2023, the InfoStealer market is a reasonably crowded affair. The likes of RedLine, Raccoon, and Vidar own a significant market share, with new entrants such as SaphireStealer appearing frequently. The latest entry, ExelaStealer has now taken the field. Very little backstory is available on ExelaStealer, with the earliest public mentions FortiGuard Labs could locate occurring in August 2023.

FortiGuard Labs research reveals that ExelaStealer is a largely open-source InfoStealer with paid customizations available from the threat actor. It is written in Python, although it pulls resources from other languages (e.g., JavaScript) where needed. It can steal sensitive information from a Windows-based host (e.g., passwords, credit cards, cookies and session data, and general keylogging).

FortiGuard Labs was able to obtain a sample. This blog will analyze its inner workings.

Advertising

Advertising on the Dark Web for ExelaStealer offers both an open-source and paid-for version. These advertisements also provide good insight into its capabilities.

Some ads appear to have been posted by the prime contact for ExelaStealer, an individual or group using the handle “quicaxd.”

As shown in Figure 2, the cost for a month of use is $20, while three months is $45. A lifetime subscription is $120. Additionally, its Telegram channel is shown, which was active at the time of writing. Its Telegram home allows individuals to purchase a copy of the paid-for version and the GitHub repo for the open-source version.

Building the Malware

Anyone with the necessary skills could create an ExelaStealer binary using the freely available source code.

The malware can currently only be compiled and packaged on a Windows-based host. The primary code for the malware is contained in a file named “Exela.py.”

The build process is initiated using a batch file that then calls Python and the “builder.py” file.

The builder uses a file named “obf.py” to make the calls necessary to obfuscate ExelaStealer’s code, making it harder to analyze.

The non-library and now obfuscated code is distilled into a file named “Obfuscated.py,” which is ready for use.

Initial Infection Vector

The binaries analyzed by FortiGuard Labs appeared to have been released as part of a specific campaign. The use of a decoy document supports this.

Unfortunately, the initial infection vector was not available to us. However, initial infection could be achieved in any number of ways (e.g., phishing, watering holes, other malware, etc.).

sirket-ruhsat-pdf.exe (f96bc306a0e3bc63092a04475dd4a1bac75224df242fa9fca36388a1978ce048)

This binary acts as a container and first stage for the deployment. Its job is the spawning of the “sirket-ruhsat-pdf.exe”  (95d860570b2777d7af213f9b48747d528251facada54842d7a07a5798fcbfe51) executable and launching a PDF viewer to display a decoy document (BNG 824 ruhsat.pdf) to the user.

It will deposit both files into the root of the C: Drive.

BNG 824 ruhsat.pdf

“sirket-ruhsat-pdf.exe” automatically attempts to find a compatible viewer and launch “BNG 824 ruhsat.pdf”. The PDF is a copy of a Turkish vehicle registration certificate for a Dacia Duster. The document is entirely benign and simply a visual decoy to the user.

Static Analysis of sirket-ruhsat-pdf.exe (95d860570b2777d7af213f9b48747d528251facada54842d7a07a5798fcbfe51)

“sirket-ruhsat-pdf.exe” is a PyInstaller executable. As such, a tool such as “pyinstxtractor” (https://github.com/extremecoders-re/pyinstxtractor) can extract the archive’s contents for inspection.

The executable is most likely signed with a fraudulent or invalid certificate and uses the name “Runtime Broker,” a legitimate Microsoft process.

Figure 10 shows the compiled version of the “Obfuscated.py” file. Using another tool, such as “pycdc” (Python Byte-code Disassembler/Decompiler – https://github.com/zrax/pycdc), the code in “Obfuscated.pyc” can be decompiled.

Unfortunately, as good as its word, function names and variable values in the file are heavily obfuscated, increasing the time required to analyze it statically. That does not make it impossible, however.

A large blob of data in the code looks out of place compared to the rest of the instructions.

Functions at the end of the file allow for its decoding and execution.

By taking those functions and depositing them with the blob into a test script, we can obtain the full decoded contents for review. Figure 14 shows the final output, which you’ll note is the code for “Exela.py.” except in this case, it is being used in the wild.

Dynamic Analysis of sirket-ruhsat-pdf.exe (95d860570b2777d7af213f9b48747d528251facada54842d7a07a5798fcbfe51)

Turning our attention to dynamic analysis, the first activity that “sirket-ruhsat-pdf.exe” will complete is spawning itself in a new process.

ExelaStealer then runs the following two commands:

• C:Windowssystem32cmd.exe /c “ver”
• wmic csproduct get uuid

These collect the version of Windows and the host’s UUID (Universally Unique Identifier).

What follows next is a base-64 encoded PowerShell command.

Decoded, this command attempts to grab a screenshot of whatever is currently displayed on the screen.

A flurry of both PowerShell and command-line items then follows:

• powershell.exe -Command ” $clipboardData = Get-Clipboard -Format Image $destinationPath = “C:UsersuserAppDataLocalTemp0000000-0000-0000-0000-D05099DB2397last_clipboard_image.png” $clipboardData.Save($destinationPath)”
• C:Windowssystem32cmd.exe /c “echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Startup Info#### & wmic startup get caption,command & echo ####Firewallinfo#### & netsh firewall show state “
• netsh wlan export profile
• C:Windowssystem32cmd.exe /c “netsh wlan show profile

These commands copy images from the Clipboard and gather basic system information, basic physical disk information, user information, firewall status, and, interestingly, WLAN status and profile.

To store this information locally before sending it back to the TA, a folder is created in “C:Users<user>AppDataLocalTemp” and named using the UUID of the host.

Each text file contains a URL back to the Telegram channel of the TA.

The files are packaged into a Zip archive using the same name as the folder (the UUID). This is then sent using a Discord webhook (https://discord.com/developers/docs/resources/webhook) to post to a TA-controlled Discord channel.

Conclusion

Data has become a valuable currency, and because of this, attempts to gather it will likely never cease. InfoStealer malware exfiltrates data belonging to corporations and individuals that can be used for blackmail, espionage, or ransom. Despite the number of infostealers in the wild, ExelaStealer shows there is still room for new players to emerge and gain traction.

Fortinet Protections

Fortinet customers are already protected from this malware through FortiGuard’s Web Filtering, AntiVirus, FortiMail, FortiClient, and FortiEDR services, as follows:

The following (AV) signature detects the malware samples mentioned in this blog

• W32/ExelaStealer.0943!tr
• W32/ExelaStealer.C93A!tr

The WebFiltering client blocks all network-based URIs.

Fortinet has multiple solutions designed to help train users to understand and detect phishing threats:

The FortiPhish Phishing Simulation Service uses real-world simulations to help organizations test user awareness and vigilance to phishing threats and to train and reinforce proper practices when users encounter targeted phishing attacks.

We also suggest that organizations have their end users undergo our FREE NSE training: NSE 1 – Information Security Awareness. It includes a module on Internet threats designed to help end users learn how to identify and protect themselves from various types of phishing attacks.

If you think this or any other cybersecurity threat has impacted your organization, contact our Global FortiGuard Incident Response Team.

IOCs

File-based IOCs:

Network-based IOCs: