Arkanix Stealer Targets Browser, Wallet and VPN Data, Researchers Find
Summary
Researchers analyzed Arkanix, a stealer advertised on Discord that can collect browser, wallet, VPN and other data. Its C++ version uses process injection to bypass Chrome App-Bound Encryption; the command server was unavailable during analysis.
Key points
- Arkanix is advertised through Discord and online forums; researchers found Python and C++ versions developed within a short period.
- The Python version is packaged with Nuitka and fetches and runs its main stealer code in memory.
- The malware can collect browser credentials and autofill data, wallet information, Discord tokens, VPN data, Wi-Fi passwords, screenshots and selected local files.
- When enabled, the Python version can spread through Discord by sending itself to contacts and channels.
- The C++ version uses the Chrome Elevator tool to inject code into browser processes, bypassing Chrome App-Bound Encryption to extract browser data.
- The analyzed C++ version can also harvest information from RDP files; unlike the Python version, it lacks Discord self-spreading.
- The command server was unavailable during analysis, preventing researchers from examining additional fetched payloads.
Article Details
- Attack Vectors
- Arkanix is reportedly distributed through Discord and online forums, including as purported legitimate tools.
- The Python version fetches and runs stealer code from a remote server; the article says an appropriate token must be set for the HTTP session.
- When self-spreading is enabled, the Python version sends itself to Discord contacts and channels.
- The native version uses process injection into Chrome to run code in the browser context and extract browser data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 6960d27fea1f5b28565cd240977b531cc8a195188fc81fa24c924da4f59a1389 | SHA-256 hash of the native-code Arkanix version. |
| SHA256 | 6ea644285d7d24e09689ef46a9e131483b6763bc14f336060afaeffe37e4beb5 | SHA-256 hash of the Python-based Arkanix version. |
MITRE ATT&CK
Malware
Products
Braveand run from the %TEMP% folder. Chrome Extractor is able to extract data from both Edge, Chrome and Brave browsers. EdgeThe malware supports collecting information from a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of themExpressVPNVPN data from Mullvad, NordVPN, ExpressVPN and ProtonVPN are collected.Google Chromesupports collecting information from a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of themMullvadVPN data from Mullvad, NordVPN, ExpressVPN and ProtonVPN are collected.NordVPNVPN data from Mullvad, NordVPN, ExpressVPN and ProtonVPN are collected.Operacollecting information from a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of them beingProtonVPNVPN data from Mullvad, NordVPN, ExpressVPN and ProtonVPN are collected.Torinformation from a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of them being Crypto/WalletVivaldiinformation from a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of them being Crypto/WalletYandexfrom a variety of Chromium-based browsers, popular ones being Edge, Chrome, Opera, Vivaldi, Tor, Yandex etc. Collects data from a long list of browser extensions, most of them being Crypto/Wallet related. Some
Tools
Chrome ElevatorTo defeat ABE, the native version of the stealer, employs ‘Chrome Elevator’ a post exploitation tool which uses process injection to inject a binary into the Chrome process and lets the injected code dump Chrome data byChrome ExtractorThe tool is stored in the binary as a PE resource and is extracted and run from the %TEMP% folder. Chrome Extractor is able to extract data from both Edge, Chrome and Brave browsers. NuitkaThe Python-based version of the malware has been distributed by packaging it via Nuitka, which compiles Python code into byte code. It can generate a self-contained executable which can run without the need forVMProtectcredentials, and of course “Support”. The threat actors provide obfuscation for payloads by employing VMProtect.