Rewterz Threat Alert – Masad Stealer

Tuesday, October 8, 2019

Severity

Medium

Analysis Summary

A new Trojan-delivered spyware that uses Telegram to exfiltrate stolen information. Using Telegram as a Command and Control (CnC) channel allows the malware some anonymity, as Telegram is a legitimate messaging application with 200 million monthly active users. 

The malware is being advertised on black market forums as “Masad Clipper and Stealer”. It steals browser data, which might contain usernames, passwords and credit card information. Masad Stealer also automatically replaces cryptocurrency wallets from the clipboard with its own.

Masad Stealer sends all of the information it collects – and receive commands from – a Telegram bot controlled by the threat actor deploying that instance of Masad. Because Masad is being sold as off-the-shelf malware, it will be deployed by multiple threat actors who may or may not be the original malware writers.

When Masad Stealer is executed, it drops itself in %APPDATA%\folder_name}\{file_name}, where folder_name and file_name are defined in the binary. Examples include amd64_usbhub3.inf.resources and ws2_32.exe, respectively. As a persistence mechanism, mMasad Stealer creates a scheduled task that will start itself every one minute.

schtask.png

It zips this information into a file using 7zip utility, which is bundled into the malware binary.

stolen_info.png

Impact

  • Credential theft
  • Financial loss
  • Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

  • e968affb1fc7756deb0e29807a06681d09a0425990be76b31816795875469e3d
  • 4b1ccf6b823ee82e400ba25b1f532cd369d7e536475a470e2011b77ffeaf7bb3
  • fc84d6636a34ad1a11dbaa1daec179e426bdcd9887b3d26dc06b202417c08f95
  • 9ca15f15fbae58cb97b0d48a0248461e78e34e6d530338e3e5b91f209a166267
  • 31f3a402c1662ed6adffbf2b1b65cf902d1df763698eb76d21e4e94b4c629714
  • 8d9f124ddd69c257189f1e814bb9e3731c00926fc2371e6ebe2654f3950ca02e
  • a0923d7645604faaa864a079adeb741a5d6e65507a2819b2fee4835d396077d9
  • a19b790ea12f785256510dde367d3313b5267536a58ca0c27dbdac7c693f57e1
  • f030fb4e859ee6a97c50c973a73dced3640befe37f579cfd15367ce6a9bbede2
  • f01db6d77ac21211992ceae4e66e1e03c1cb39d61e03645b9369f28252ca7693
  • dfe3d0e95feaed685a784aed14d087b019ba2eb0274947a840d2bdbae4ae3674
  • bf6083040ca51e83415f27c9412d9e3d700bd0841493b207bc96abf944ab0ca7
  • b154151dc8ace5c57f109e6bb211a019db20c4f0127c4d13c7703f730bf49276
  • 6bf6b1bde63cee9b81902efd187fdd56ecee5853754ce0a19d5ab5c3b0242988
  • 0dcf547bd8f4074af97416d8b84ea64b2f3319064aa4bce64ad0c2e2d3957175
  • 6cff1249cc45b61ce8d28d87f8edc6616447e38168e610bed142f0b9c46ea684
  • 5b5ebe019806885bbaafe37bc10ca09549e41c240b793fd29a70690a5d80b496
  • 103d87098c9702cab7454b52869aeeb6a22919f29a7f19be7509255ce2d8c83e
  • c73675005a09008bc91d6bc3b5ad59a630ab4670dca6ac0d926165a3ecfd8d92
  • ef623aadd50330342dc464a31b843b3d8b5767d62a62f5e515ac2b380b208fbe
  • 3ba3c528d11d1df62a969a282e9e54534fb3845962672ad6d8bbc29cb6d062f5
  • b763054180cd4e24c0a78b49055ad36dbc849f1a096cddf2db8cee0b9338c21d
  • d5ce4b04b7eec6530a4a9d40510177468fadc235253e5a74530a8c9d990f3c50
  • 965a5949d8f94e17ebcd4cb6d0a7c19f49facbfc1b1c74111e5ceb83550d6c8f
  • 44134b9d4b10d94f6381b446a1728b116d62e65c1a52db45235af12caf7e38c0
  • 848d76a227f4fe282b7ddfd82a6dfc4c25da2735a684462b42fe4e1c413d8e34
  • 5ca0a957fe6c253827f344da4ba8692d77a4e21a1df4251594be2d27d87dd8ae
  • 016fa511f6546ed439d2606c6db8821685a99f5a14ef3f710668b58dc89c6926
  • 22be594fbfa878f631c0632f6c4d260b00918817ff66a1f9f15efe44c1a58460
  • f3571ec66288405dab43332ca03812617f85fb08832fbbe1f1d89901fe034b8a
  • 04c949eca23103b1de05278b49f42c3ab6b06f4bf20aafa5f2faefaa84c16ecd
  • e968affb1fc7756deb0e29807a06681d09a0425990be76b31816795875469e3d
  • d6fc04acda8f33a6d35eb577c27754c2f2b4d6f4869576c7c4e11b2c5e9b0176
  • 18c0bd4dd98008383fc52045ad896449fa7f0037593bb730ed1ef88aa547006d
  • 4c9d5469e9095813418260045c2b11e499e4eaa0ffb25293f90f580c464157df
  • 0b5f1fbc05dc8baca492b748adeb01fb4904e02723b59211ecde222f7b12d91e
  • 31ad5c4547ceae4d0550c8460524c16a6105afc056760e872c4966656256c9dc
  • edb00a0e5ff70e899857549e3263c887a799416c8bbab43ab130ca1be9bbd78c
  • 96f852b81760a425befaa11ea37c0cdea2622630bf2a0c94bb95042211ab614d
  • 57fd171a5b1a88e9583b42439851a91a940eb31105ab29cb314846da2ed43b82
  • 277018b2cc6226dca6c7678cac6718c8584f7231340ad8cd7c03477559fdf48b
  • 1acf5a461ee16336eb8bbf8d29982c7e26d5e11827c58ca01adac671a28b52ad
  • 290a1b89517dec10bfd9938a0e86ae8c53b0c78ed7c60dc99e4f8e5837f4f24a
  • 7937a1068f130a90b44781eea3351ba8a2776d0fede9699ba8b32f3198de045b
  • 87e44bca3cc360c64cc7449ec1dc26b7d1708441d471bf3d36cd330db3576294
  • cf97d52551a96dacb089ac41463d21cab2b004ba8c38ffc6cb5fb0958ddd34db
  • 79aa23c5a25c7cdbaba9c6c655c918dac3d9823ac62ebed9d7d3e94e1eaafc07
  • 03d703f6d341be258ac3d95961ff0a67d4bf792f9e896530e193b091dca29c2e
  • a368b6755e62e5c0ff79ea1e3bd146ee8a349af309b4acf0558a9c667e78293a
  • ba933cefbe9a8034f0ba34e7d18481a7db7451c8ef4b6172fb0cad6db0513a51

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.

Data Sheets

Corporate Brochure


Our Story


Services


Solutions


Managed Security


Upcoming Rewterz Trainings/Events

Rewterz News

  • 11, October 2019 Rewterz Threat Alert – Kimsuky Group – IOC’s
  • 11, October 2019 Rewterz Threat Advisory – CVE-2019-10936 – Siemens PROFINET Devices Denial of Service Vulnerability
  • 11, October 2019 Rewterz Threat Advisory – CVE-2019-10923 – Siemens Industrial Real-Time (IRT) Devices DoS Vulnerability
  • 10, October 2019 Rewterz Threat Alert – Another Agenttesla campaign using a compromised Iraq Government site

Copyright © Rewterz. All rights reserved.