Beware of New AsukaStealer Steal Browser Passwords & Desktop Screens

An updated version of the ObserverStealer known as AsukaStealer was observed to be advertised as malware-as-a-service that was capable of collecting data from desktop screenshots, Steam Desktop Authenticator application, FileZilla sessions, Telegram sessions, Discord tokens, browser extensions, and cryptocurrency wallets.

This year, on a Russian-language forum, the threat actor advertised AsukaStealer as a MaaS (Malware-as-a-service), providing an extensive list of features meant to steal confidential data from the targets.

AsukaStealer malware is written in C++ and has flexible options and a web-based control panel. The malware authors or developers used the same C&C infrastructure to host AsukaStealer and ObserverStealer.

Notable Features of AsukaStealer

Cyble Research & Intelligence Labs (CRIL) discovered a malware-as-a-service (MaaS) known as “AsukaStealer” on February 2, 2024.

The malware was sold on a Russian-language cybercrime forum, with the web panel version 0.9.7 being offered for USD 80 per month.

On January 24, 2024, the AsukaStealer was marketed on another famous Russian forum under an alternate pseudonym.

Advertisement of AsukaStealer on the forum

The stealer had certain noteworthy features, such as:

Functional features: 

  • The native styler is written in C++ and is 280 kb.
  • Collects browser data (Cookies, Passwords, AccountsSync, Extensions) on Chromium (Edge, Google, OperaGX) and Gecko (Firefox, Waterfox) engines.
  • Collects Discord tokens.
  • Collects FileZilla sessions (FileGrabber|Standard config).
  • Collects Telegram sessions (ProcessGrabber|FileGrabber|Standard config).
  • Builds Steam (Standard config).
  • There is functionality for uploading a file after collecting the log (Loader).
  • Ability to install custom proxies.
  • Ability to send logs to telegram.
  • Collects a screenshot from the desktop.
  • Collecting maFiles from the Steam Desktop Authenticator application (ProcessGrabber|Standard config).
  • An anti-duplicate system.
Total information collected by the malware

Configuration setup:

  • Customizable list of browsers [Chromium, Gecko].
  • Customizable FileGrabber/crypto wallet files.
  • Customizable list of extensions.
  • Customizable ProcessGrabber.
  • Customizable Loader.
  • Customizable Discord clients.

Multiple files that were interacting with the IP address “5.42.66.25” were discovered by researchers; VirusTotal had identified and flagged these files as ObserverStealer.

The  AsukaStealer and ObserverStealer’s C&C panels have remarkably similar features.

The promoters of AsukaStealer MaaS also announced the termination of MaaS activities for ObserverStealer, which researchers noticed during the study in July 2023.

This suggests that the same threat actors created and managed both stealer malware.

ObserverStealer on offer and announcement of its closure

Notably, this threat was classified by Symantec as File-based (Infostealer Trojan.Gen.MBT), Machine Learning-based (Heur.AdvML.B), and Web-based.

All products with WebPulse enabled covered the observed domains and IPs under security categories.

“Threat actors who are proficient in malware development and capable of hosting a sizable C&C infrastructure, continue to seize opportunities to offer malware-as-a-service (MaaS) to cater to underground communities and make profits within a short period of time”, researchers said.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning and…

18 hours ago

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is transmitted…

18 hours ago

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services (IIS)…

18 hours ago

Hackers Leveraging Image & Video Attachments to Deliver Malware

Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques like…

21 hours ago

New Scareware Attack Targeting Mobile Users to Deploy Malicious Antivirus Apps

A new wave of scareware attacks has emerged, targeting unsuspecting mobile users with fake antivirus…

21 hours ago

Ghidra 11.3 Released – A Major Update to NSA’s Open-Source Tool

The National Security Agency (NSA) has officially released Ghidra 11.3, the latest iteration of its…

21 hours ago