Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

‘Masad Stealer’ Uses Telegram to Exfiltrate Data

A recently identified data stealer is using Telegram to exfiltrate information harvested from infected machines, Juniper Networks security researchers say.

A recently identified data stealer is using Telegram to exfiltrate information harvested from infected machines, Juniper Networks security researchers say.

Marketed on underground forums as “Masad Clipper and Stealer,” the malware targets browser data, in an attempt to collect from there usernames, passwords and credit card information. Additionally, the threat can replace cryptocurrency wallet addresses on the clipboard with its own.

Written using AutoIt scripts and compiled into a Windows executable, Masad Stealer’s binary is only 1.5 MB in size. However, it can also be found bundled into other software, the researchers say. 

When executed, the malware drops itself in %APPDATA%folder_name}{file_name}. For persistence, it creates a scheduled task to start itself every minute.

Next, Masad Stealer starts collecting sensitive information from the system, including cryptocurrency wallet data, PC and system information, credit card data and passwords from browsers, installed software and processes, desktop files, browser cookies, Steam files, AutoFill browser fields, Discord and Telegram data, and FileZilla files, and also takes a screenshot of the desktop.

The information is archived using 7zip, which is bundled into the malware binary. The ZIP file is sent to the command and control (C&C) server using a hardcoded bot token, via the sendDocument Telegram bot API, Juniper Networks says.

When establishing communication between the C&C and the bot, a getMe message using the bot token is sent, to which the bot responds with the user object containing the username of the bot. With multiple actors using this malware, the username object is useful for identification purposes. 

Masad Stealer can replace crypto-wallets on the clipboard with attacker-specified wallets, if they match particular configuration. The threat targets Monero, Bitcoin Cash, Litecoin, Neo, Web Money, ADA, ZCASH, DogeCoin, Stratis, QIWI Pay, Bicond, Waves, Reddcoin, Qtum, Payeer, Bytecoin, Bitcoin, Black Coin, VIA, Steam Trade Link, Bitcoin Gold, Emercoin, Lisk, Ethereum, Dash, Ripple, and Yandex Money. 

The stealer is being distributed masquerading as a legitimate tool and bundled into third party tools. The applications are then advertised on forums, third party download sites, or file sharing sites. In some cases, Masad Stealer can download additional malware, usually a miner. 

Masad Stealer is being advertised on hack forums starting at free, with its price going up to $85, depending on the selected tier and the features the buyer is looking to receive. The researchers also discovered a dedicated website that promotes the malicious program. 

The malware authors also created a Telegram group that potential clients can join, and where they might also be offering tech support to them. At the moment, the group has more than 300 members.

To date, over 1,000 Masad Stealer samples have been identified, as well as 338 unique Telegram C&C bot IDs. 

Related: New Variant of HawkEye Stealer Emerges

Related: Baldr Stealer Malware Active in the Wild With Ongoing Updates

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Cyberwarfare

Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Malware & Threats

Security researchers are warning of a new wave of malicious NPM and PyPI packages designed to steal user information and download additional payloads.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.