Celestial Stealer Checks for Researcher Names and Stops Running to Evade Analysis
Summary
Trellix found that Celestial Stealer, a JavaScript infostealer sold as a service, uses anti-analysis checks and terminates when it detects certain usernames or computer names, including those linked to a Huntress researcher.
Key points
- Celestial Stealer is a JavaScript infostealer advertised on Telegram as a malware-as-a-service with weekly, monthly, and lifetime subscriptions.
- The malware uses anti-VM and other anti-analysis techniques intended to hinder researchers and avoid detection.
- It checks lists of usernames and computer names that may indicate analysis and terminates if it detects a match.
- The list includes Huntress researcher Jai Minton and his alias, according to the article.
- The article says the malware may skip collecting browser passwords, cookies, payment-card details, and cryptocurrency wallets on machines matching those names.
Article Details
- Event Type
- Security research report on Celestial Stealer, a JavaScript-based infostealer with anti-analysis checks that terminate the malware when specified usernames or computer names are detected.
- Impact
- Celestial Stealer can steal credentials, browser cookies, saved credit card information, cryptocurrency wallet data, and files from infected systems. The reported name checks may cause it to skip machines associated with analysis, including one matching Huntress researcher Jai Minton’s name or alias, and terminate to hinder detection and reverse engineering. The article reports no specific victim organization or confirmed incident.