Authors
Introduction
Information stealers, which are used to collect credentials to then sell them on the dark web or use in subsequent cyberattacks, are actively distributed by cybercriminals. Some of them are available through a monthly subscription model, thus attracting novice cybercriminals. According to Kaspersky Digital Footprint Intelligence, almost 10 million devices, both personal and corporate, were attacked by information stealers in 2023. That said, the real number of the attacked devices may be even higher, as not all stealer operators publish all their logs immediately after stealing data.
This year, we analyzed quite a few previously known and new stealers, which we described in detail in our private reports. You will find a few excerpts from these below. To learn more about our crimeware reporting service, contact us at [email protected].
Kral
In mid-2023, we discovered the Kral downloader which, back then, downloaded the notorious Aurora stealer. This changed in February this year when we discovered a new Kral stealer, which we believe is part of the same malware family as the downloader due to certain code similarities.
The Kral stealer is delivered solely by the Kral downloader. The downloader itself sneaks onto the user’s device when a potential victim visits an adult website that embeds malicious ads. These redirect the victim to a phishing page which offers them to download a file. That file is the Kral downloader. Back in 2023, the downloader was written in a combination of C++ and Delphi, which resulted in relatively large samples. These days, the downloader is solely written in C++, which has shrunk the size of the payload tenfold.
The Kral stealer has quite some similarities with the downloader. Both are signed and both use the same function for binary integrity verification ( WinVerifyTrust()). Also, they both use the same key for string encryption. Last but not least, the Kral name is used in the PDB paths to both binaries.
In terms of functionality, the stealer is particularly interested in cryptocurrency wallets and browser data. A random folder is created in C:\ProgramData\, where stolen data, as well as information about the system (local time, time zone, CPU, etc) are stored. The folder is then zipped and sent to the C2 via the COM interface of the Background Intelligent Transfer Service (BITS). The stealer only collects data once. However, if the user launches it again, it will steal once more.
AMOS
The AMOS stealer targeting macOS was first identified in early 2023. In June 2024, we discovered a new domain delivering this malware. The website impersonated the Homebrew package manager. Following a deeper investigation, we found out that users ended up on this site through malvertising.
