Analysis Reveals Python-Based MaaS Infostealer Builder and Windows-Stealing Payload
Summary
Analysis of a nested archive uncovered a Python-based MaaS builder and Windows infostealer. The payload evades analysis, persists through a registry key and scheduled task, steals credentials and other data, and exfiltrates it via webhook.
Key points
- A nested archive contained a Python-based builder and an embedded Windows infostealer payload.
- The builder supports customized executables using Nuitka or PyInstaller, with webhook settings encoded and injected into the payload.
- The malware uses debugger, process, disk-size, and timing checks to evade analysis.
- It persists through a Windows Run key and an ONLOGON scheduled task.
- Targets include Chromium and Firefox data, Discord tokens, Roblox cookies, saved Wi-Fi passwords, and system and location details.
- Collected data is packaged into an in-memory ZIP archive and sent to an attacker-controlled webhook.
- Suggested detection opportunities include unusual pip.exe execution, suspicious persistence creation, access to browser data, Wi-Fi enumeration, and unknown webhook traffic.
Article Details
- Attack Vectors
- A nested archive, my new program called 2.rar, contained TokenGrabberBuilder.zip with a Python-based builder and embedded Windows infostealer payload.
- The builder enables customized payloads configured to exfiltrate collected data through a webhook.
- The payload steals browser credentials and cookies, Firefox data, Wi-Fi passwords, Discord tokens, Roblox session cookies, and system and geolocation information.
- The payload establishes logon persistence through a Windows Run key and a scheduled task, and uses debugger, process, disk-size, and timing checks to evade analysis.
- Collected data is packaged into an in-memory ZIP archive and sent through an HTTP POST to an attacker-controlled webhook.
- Defensive Notes
- Monitor unexpected pip.exe execution from non-development applications.
- Monitor suspicious Windows Run key and scheduled-task creation, including tasks configured to run at logon.
- Investigate use of netsh wlan show profiles and access to browser credential, history, and cookie databases.
- Monitor suspicious HTTP POST requests to unknown webhook endpoints and ZIP archives containing collected system data.
- The article recommends keeping security products up to date and exercising caution with downloaded files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 429ed63ab3fbda8d22d0ac750ecfe8cc | Hash listed in the article's IOCs with the detection name Password-Stealer (006dba241). |
| MD5 | 610f0c65a3f8e88559f89ed90ea9ee5c | Hash listed in the article's IOCs with the detection name Password-Stealer (006dba241). |
| MD5 | 9ffe0e45c7a3f20e4481206c1c3b0854 | Hash listed in the article's IOCs with the detection name Trojan (006e632e1). |
| URL | hxxps[:]//pastebin[.]com/api/api_post[.]php | Decoded string identified by the article as a secondary exfiltration endpoint. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload reads local browser and Firefox databases and profile files to collect credentials, cookies, and history.T1027 · Obfuscated Files or InformationThe builder and payload XOR- and Base64-encode strings, including the webhook URL, before decoding them at runtime.T1036 · MasqueradingThe payload uses the Run key name WindowsUpdate to mimic a legitimate Windows component.T1041 · Exfiltration Over C2 ChannelThe payload sends a ZIP archive of stolen data to an attacker-controlled webhook using an HTTP POST request.T1053.005 · Scheduled TaskThe payload creates a scheduled task configured to run at user logon.T1057 · Process DiscoveryThe payload enumerates running processes and terminates when it finds names associated with virtualization or analysis environments.T1119 · Automated CollectionThe stealer automatically collects browser data, Discord tokens, Wi-Fi profiles, and system information.T1497.001 · System ChecksThe payload checks for virtualization-related processes and exits when disk capacity is below 50 GB.T1497.003 · Time Based ChecksThe payload uses a variable sleep duration derived from the process ID to introduce timing delays.T1528 · Steal Application Access TokenThe payload scans Discord LevelDB data for tokens, validates them against the Discord API, and includes active tokens in the stolen data.T1539 · Steal Web Session CookieThe stealer collects browser and Firefox session cookies, including Roblox .ROBLOSECURITY cookies.T1547.001 · Registry Run Keys / Startup FolderThe payload writes persistence under the Windows Run key using the deceptive key name WindowsUpdate.T1555.003 · Credentials from Web BrowsersThe payload extracts and decrypts saved Chromium browser credentials, including using DPAPI to recover the browser's encrypted master key.T1622 · Debugger EvasionThe payload calls the Windows IsDebuggerPresent() API through ctypes to check for an attached debugger.
Products
DiscordThe malware uses MaaS-style customization, anti-analysis checks, persistence, browser and Discord credential theft, Wi-Fi password harvesting, and webhook-based exfiltration to steal data.Microsoft WindowsA nested archive named my new program called 2.rar ultimately revealed TokenGrabberBuilder.zip, which contained a Python-based builder and an embedded infostealer payload targeting Windows systems.Mozilla FirefoxThe stealer targets browser credentials, Firefox data, Wi-Fi passwords, Discord tokens, Roblox cookies, and system/geolocation information before exfiltrating it in a ZIP archive via webhook.Roblox#TokenGrabberBuilder #stealer.py