Stealthy Python Malware Uses Discord to Steal Windows Data
Inf0s3c Stealer is a Python-based malware designed to extract system information and user data from Windows systems. The malware is packaged as a 64-bit Portable Executable (PE) file using UPX and PyInstaller. It employs various Windows API functions to…
Inf0s3c Stealer is a Python-based malware designed to extract system information and user data from Windows systems. The malware is packaged as a 64-bit Portable Executable (PE) file using UPX and PyInstaller. It employs various Windows API functions to perform tasks such as process enumeration, directory navigation, memory manipulation, and security management.
Upon execution, Inf0s3c Stealer collects host identifiers, CPU details, network configurations, and takes screenshots. It scans user folders including Desktop, Documents, Pictures, and Downloads, compiling the data into a temporary workspace. This data is then packaged into a password-protected RAR archive and exfiltrated to an attacker-controlled Discord channel.
Collects system information, running processes, directory trees, and saved Wi-Fi credentials. Captures screenshots and webcam images, and displays deceptive error dialogs. Targets saved passwords, cookies, autofill entries, browsing history, crypto wallets, Discord tokens, and Telegram sessions. Injects code into Discord for persistence and token harvesting. Achieves persistence through Windows Startup folder installation and optional UAC bypass. Employs anti-analysis features such as virtual machine checks and blocking of antivirus update sites. Includes a self-deletion ("melt") feature to erase traces. Utilizes a "pump stub" feature to inflate executable size and evade heuristic detections.
The import table of the malware lists functions in several categories:
Inf0s3c Stealer is a Python-based malware designed to extract system information and user data from Windows systems.
File/Directory Operations: Functions like WriteFile, DeleteFileW, and FindFirstFileW. Process Management: Includes OpenProcessToken, GetTokenInformation, and K32EnumProcessModules. System Control: Functions such as GetEnvironmentVariableW and SystemParametersInfoW. Memory/Anti-Debug: Utilizes VirtualProtect, RaiseException, and QueryPerformanceFrequency. Security Management: Includes ConvertStringSecurityDescriptorToSecurityDescriptorW.
The malware is packed with UPX and PyInstaller, concealing Python libraries and scripts. An analysis revealed routines using rar.exe to create password-protected archives, confirming its secure packaging mechanism.
Build.exe, when executed, runs PowerShell and CMD commands to gather system information, saving outputs as text files. It captures screenshots as PNG images and organizes artifacts into subdirectories within a %TEMP% workspace. The data is archived into a RAR file and uploaded via a Discord webhook for exfiltration.
Inf0s3c Stealer's architecture, obfuscation techniques, and Discord-based exfiltration reflect a trend towards sophisticated Python malware. It highlights the importance of enhanced endpoint protection, network monitoring, and threat intelligence sharing to mitigate such threats.
Proactive security measures including continuous monitoring, robust endpoint controls, user training, and rapid threat intelligence dissemination are crucial to detect and mitigate emerging variants.
Based on reporting by GBHackers.