Beware of New AsukaStealer Steal Browser Passwords & Desktop Screens

An updated version of the ObserverStealer known as AsukaStealer was observed to be advertised as malware-as-a-service that was capable of collecting data from desktop screenshots, Steam Desktop Authenticator application, FileZilla sessions, Telegram sessions, Discord tokens, browser extensions, and cryptocurrency wallets.

This year, on a Russian-language forum, the threat actor advertised AsukaStealer as a MaaS (Malware-as-a-service), providing an extensive list of features meant to steal confidential data from the targets.

AsukaStealer malware is written in C++ and has flexible options and a web-based control panel. The malware authors or developers used the same C&C infrastructure to host AsukaStealer and ObserverStealer.

Notable Features of AsukaStealer

Cyble Research & Intelligence Labs (CRIL) discovered a malware-as-a-service (MaaS) known as “AsukaStealer” on February 2, 2024.

The malware was sold on a Russian-language cybercrime forum, with the web panel version 0.9.7 being offered for USD 80 per month.

On January 24, 2024, the AsukaStealer was marketed on another famous Russian forum under an alternate pseudonym.

The stealer had certain noteworthy features, such as:

Functional features: 

• The native styler is written in C++ and is 280 kb.
• Collects browser data (Cookies, Passwords, AccountsSync, Extensions) on Chromium (Edge, Google, OperaGX) and Gecko (Firefox, Waterfox) engines.
• Collects Discord tokens.
• Collects FileZilla sessions (FileGrabber|Standard config).
• Collects Telegram sessions (ProcessGrabber|FileGrabber|Standard config).
• Builds Steam (Standard config).
• There is functionality for uploading a file after collecting the log (Loader).
• Ability to install custom proxies.
• Ability to send logs to telegram.
• Collects a screenshot from the desktop.
• Collecting maFiles from the Steam Desktop Authenticator application (ProcessGrabber|Standard config).
• An anti-duplicate system.

Configuration setup:

• Customizable list of browsers [Chromium, Gecko].
• Customizable FileGrabber/crypto wallet files.
• Customizable list of extensions.
• Customizable ProcessGrabber.
• Customizable Loader.
• Customizable Discord clients.

Multiple files that were interacting with the IP address “5.42.66.25” were discovered by researchers; VirusTotal had identified and flagged these files as ObserverStealer.

The  AsukaStealer and ObserverStealer’s C&C panels have remarkably similar features.

The promoters of AsukaStealer MaaS also announced the termination of MaaS activities for ObserverStealer, which researchers noticed during the study in July 2023.

This suggests that the same threat actors created and managed both stealer malware.

Notably, this threat was classified by Symantec as File-based (Infostealer Trojan.Gen.MBT), Machine Learning-based (Heur.AdvML.B), and Web-based.

All products with WebPulse enabled covered the observed domains and IPs under security categories.

“Threat actors who are proficient in malware development and capable of hosting a sizable C&C infrastructure, continue to seize opportunities to offer malware-as-a-service (MaaS) to cater to underground communities and make profits within a short period of time”, researchers said.