New Info-stealer Disguised as Crack Being Distributed – ASEC BLOG

The ASEC analysis team has previously uploaded posts about various malware types that are being distributed by disguising themselves as software cracks and installers. CryptBot, RedLine, and Vidar are major example cases. Recently, a single malware type of RedLine has disappeared (it is still being distributed as a dropper type) and a new infostealer malware is being actively distributed instead. Its distribution became in full swing starting from May 20th, globally categorized as “Recordbreaker Stealer.” Some analyses see it as a new version of Raccoon Stealer.

The malware is created when users search for cracks, serial numbers, installers, etc. of commercial software and access the webpage to download and decompress files.

It is mainly distributed in an abnormally large size with a huge amount of padding added. The padding is inserted between the last section and the certificate area.

As such, the size of file downloaded from a website is between 3 to 7MB, while the size of the malware created upon decompressing the file is between 300 to 700MB. The malware icons use installer images or those of popular software. In some cases, it may be distributed in a typical packing method by dropper or downloader.

When the malware is run, it downloads additional libraries depending on the command from C2 (settings value) to collect various sensitive information from the user PC and send it back to C2. The target information for stealing is decided by the C2 settings. Additional malware strains may also be installed. The following figure shows the network behaviors for the overall execution flow.

When it first accesses C2, the malware sends the user name, MachineGUID value, and hard-coded key values within the sample and receives the settings data. The data includes the list of information that will be stolen and the download URL for the libraries needed to collect information.

Initial samples had different domains for C2 and downloading libraries, but recent samples use the same URL for both. The C2s for the malware do not tend to last long. In fact, about 2 – 3 samples with new C2 domains are being distributed in a single day. The malware uses the “record” string as a value for User-Agent when communicating with the C2.

The targets for stealing in the settings data are mainly strings related to cryptocurrencies such as browser plugin wallets and open source wallets. It seems basic targets such as browser cookies, IDs, and passwords are chosen if the related libraries exist. The table below shows an example of the settings data for the analysis sample.

The sample steals basic system information, the list of installed programs, screenshots, data saved in browsers, and various cryptocurrency wallet information. The information that is stolen may vary depending on the C2’s response. For example, one type of C2 does not steal screenshots but commands the malware to steal all txt files within the desktop and subfolders of My Documents.

Since June 17th, the C2s have been responding with settings value that downloads and runs additional malware besides libraries that will be used to steal information. The currently installed malware is ClipBanker (74744fc068f935608dff34ecd0eb1f96). It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker. The history of related samples implies that the malware additionally installed other malware strains during the initial distribution stage.

The process of stealing information and installing ClipBanker is similar to that of CryptBot distribution. CryptBot is also being actively distributed at the moment.

The following table shows a part of the attacker’s wallet address.

One characteristic of Record Stealer is that it uses strings with certain meanings when decrypting strings it uses. At the initial stage, it used “credit19” as a key. Samples that are distributed after May 28th use the string “edinayarossiya”.

The sample has a code that checks if the user’s default locale (language) is Russian, but the result does not make any difference for the behaviors.

Because malware distributed by being disguised as software cracks has diverse variants and is distributed in large amounts, users need to take caution. They should not download files from untrusted websites. Also, executables that are downloaded after multiple redirections are most likely to be malicious files. Moreover, if the file’s size increases to an abnormal degree after being decompressed, it might be the case discussed earlier in this post.

AhnLab products detect and block the malware type using the following aliases:

• Infostealer/Win.RecordStealer.R498039
• Infostealer/Win.RecordStealer.R500009
• Infostealer/Win.PassStealer.R496906
• Trojan/Win.ClipBanker.C5166957
  and more

The IOC information of the distributed samples is as follows:

[IOC Information]

Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.

Source: https://asec.ahnlab.com/en/35981/