Fake Avast Site Delivers Venom Stealer That Targets Credentials and Crypto Wallets
Summary
An analysis found a fake Avast scan site delivers Venom Stealer, which masquerades as a Chrome service, steals browser credentials, session cookies and wallet data, and exfiltrates data over HTTP to app-metrics-cdn[.]com.
Key points
- The fake Avast-branded page stages a scan that reports fabricated infections and prompts users to download the malicious Avast_system_cleaner.exe.
- The executable copies itself to the Chrome application directory as v20svc.exe and uses the --v20c flag for its second-stage role.
- Analysis found Venom Stealer targets browser credentials, session cookies, cryptocurrency wallet data, and screenshots; stolen cookies may enable session hijacking.
- The malware sends collected files and parsed credentials to app-metrics-cdn[.]com over unencrypted HTTP, then periodically checks in.
- Observed evasion includes crypter packing, direct and indirect system calls, debugger and environment checks, process enumeration, and extended sleep calls.
- The article recommends downloading security software only from official vendor sites; potentially affected users should scan devices, change passwords, and end active sessions.
Article Details
- Attack Vectors
- A fake Avast-branded website stages a scan that reports fabricated infections and prompts visitors to download Avast_system_cleaner.exe.
- The downloaded file executes as Venom Stealer, copies itself into a Google Chrome application directory under the name v20svc.exe, and steals browser credentials, session cookies, wallet data, and screenshots.
- Venom Stealer uses direct and indirect system calls, debugger and environment checks, process enumeration, memory guard pages, and long sleep calls to hinder analysis and detection.
- The malware exfiltrates collected data and sends heartbeat requests over unencrypted HTTP to app-metrics-cdn[.]com.
- Defensive Notes
- Download security software only from official vendor websites; do not trust search results, ads, or unsolicited links.
- Check for v20svc.exe in C:Program FilesGoogleChromeApplication and run a full scan with an up-to-date anti-malware tool if the system may be affected.
- Change passwords for important accounts and sign out of active sessions, since stolen cookies may allow session hijacking.
- If using a desktop cryptocurrency wallet, transfer funds to a new wallet generated on a clean device.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | app-metrics-cdn[.]com | Command-and-control domain used for stolen-data exfiltration and heartbeat requests. |
| MD5 | 0a32d6abea15f3bfe2a74763ba6c4ef5 | MD5 hash shared by the malicious installer and its dropped copy. |
| SHA256 | ecbeaa13921dbad8028d29534c3878503f45a82a09cf27857fa4335bd1c9286d | SHA-256 hash of the malicious Venom Stealer binary. |
| URL | hxxp[:]//app-metrics-cdn[.]com/api/listener/heartbeat | C2 endpoint used for periodic malware check-ins. |
| URL | hxxp[:]//app-metrics-cdn[.]com/api/upload | C2 endpoint used to upload collected files over HTTP. |
| URL | hxxp[:]//app-metrics-cdn[.]com/api/upload-complete | C2 endpoint used to signal completion of data theft. |
| URL | hxxp[:]//app-metrics-cdn[.]com/api/upload-json | C2 endpoint used to upload parsed credentials and cookies over HTTP. |
MITRE ATT&CK
T1027.002 · Software PackingThe executable was packed with a crypter; the article cites the crypter_stub.pdb path as evidence.T1036.005 · Match Legitimate Resource Name or LocationThe malware copies itself to a Chrome application directory as v20svc.exe to resemble a legitimate Chrome component.T1041 · Exfiltration Over C2 ChannelStolen files and parsed credential and cookie data are exfiltrated to the malware's C2 domain.T1057 · Process DiscoveryThe malware enumerates running processes as part of its environment and anti-analysis checks.T1071.001 · Web ProtocolsThe malware uses HTTP POST requests to upload stolen data and sends HTTP heartbeat requests to its C2 domain.T1106 · Native APIThe malware uses direct and indirect system calls to invoke Windows kernel functions.T1113 · Screen CaptureThe malware captures a screenshot of the victim's desktop and temporarily saves it as a JPG file.T1204.002 · Malicious FileThe infection depends on a user downloading and executing Avast_system_cleaner.exe, presented as a fix for fabricated scan results.T1497 · Virtualization/Sandbox EvasionThe malware checks for analysis environments by querying system information, checking for a debugger, enumerating processes, and using memory guard pages.T1539 · Steal Web Session CookieThe malware steals active session cookies, including cookies for services such as Netflix, YouTube, Reddit, and Facebook.T1555.003 · Credentials from Web BrowsersVenom Stealer harvests saved browser credentials and cookie data from browser files and process memory.
Malware
Products
AvastA fake Avast-branded website performs a staged “virus scan” that prompts users to download a malicious file (Avast_system_cleaner.exe) which is actually Venom Stealer, a data-stealing payload that harvests browserGoogle Chromememory also contained fully-formed JSON structures with stolen cookie data from Microsoft Edge and Google Chrome, including active sessions for Netflix, YouTube, Reddit, Facebook, LinkedIn, AliExpress, Outlook,Microsoft EdgeProcess memory also contained fully-formed JSON structures with stolen cookie data from Microsoft Edge and Google Chrome, including active sessions for Netflix, YouTube, Reddit, Facebook, LinkedIn, AliExpress, Outlook,Mozilla FirefoxIn the analysis environment, it was observed directly accessing Firefox’s cookie database at C:Users<USER>AppDataRoamingMozillaFirefoxProfiles<profile>cookies.sqlite-shm.