2024-08-23 ANGRY STEALER (Rage stealer variant) Telegram rat . Samples

2024-08-23 Cyfirma. A Comprehensive Analysis of Angry Stealer : Rage Stealer in a New Disguise (Telegram rat).

CYFIRMA analyzed malware known as "Angry Stealer", which is heavily advertised on platforms like Telegram,   a repackaged version of the previously identified "Rage Stealer"

• The dropper is a 32-bit Win32 executable written in .NET, which acts as the initial stage of the attack. Upon execution, it deploys two key payloads: "Stepasha.exe" and "MotherRussia.exe,
• Stepasha.exe - The Info-Stealer:
  • Once deployed, "Stepasha.exe" begins an extensive data collection process. It targets sensitive information stored on the infected system, including browser data (passwords, cookies, autofill data), cryptocurrency wallets, VPN credentials, and system information.
  • The collected data is then packaged into a ZIP file and exfiltrated to a remote Telegram channel. This process leverages hardcoded credentials and bypasses SSL validation, ensuring the data reaches the attacker without interruption.
  • The malware incorporates techniques to avoid detection, such as tampering with file timestamps and ensuring only one instance runs at a time.
• MotherRussia.exe - The Builder Tool:
  • This secondary payload acts as a builder, allowing the creation of additional malicious executables. The user provides specific inputs, such as bot tokens and chat IDs, which are then embedded into the generated executable.
  • The tool is likely designed for tasks related to remote desktop operations or bot interactions, making it easier for attackers to automate and scale their malicious activities.
• Angry Stealer" is a direct descendant of "Rage Stealer," sharing the same codebase and functionality. This rebranding approach allows cybercriminals to market the same malware under different names, reaching new buyers and avoiding detection by reusing proven tactics.
• The dropper was compiled in a .NET environment, likely within an isolated setup like Windows Defender Application Guard, suggesting that the developers took precautions to avoid detection during development.

Download

Download. Email me if you need the password.

File Information

 ae25ed76f7aa901495537c2600bf149f6a56a42f28dc8fc9c6ed6c802ce0422e_MotherRussia.exe_

bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d_Stepasha.exe_

c477b037e8fe3ab68b4c1da6f9bfe01e9ea818a5b4f94ed9e2757e25035be06d exe_