Wednesday, December 6, 2023

Mitsu Malware Stealer Downloaded Through AnyDesk Phishing Site to Steal Passwords

Cybersecurity experts at Cyble Research and Intelligence Labs (CRIL) have recently identified a fake AnyDesk website (hxxp://anydesk[.]ml). 

They found this website was spreading Mitsu Stealer, and it’s a sophisticated custom-made 64-bit malware. This malware is primarily designed to steal all sensitive information from unsuspecting victims.

One of the most surprising aspects of this malware is that it is constructed from code that is freely available on GitHub.

Currently, the website has not been involved in any malvertising campaigns. However, the mediums used by the operators of this fake website for promotional purposes are:-

  • Malspam
  • SMS
  • Social networks

Infection chain

According to the report, After clicking on the Downloads button on the phishing website the infection chain begins, and the user gets infected by the malware delivered by the phishing site. The Mitsu Stealer malware was downloaded from the remote server in the following form:-

  • Anydesk.exe

It’s a 64-bit Windows executable file that is based on the Microsoft Visual C++/C++ GUI.

There is much similarity between the phishing site and Anydesk’s genuine website when it comes to its appearance. In short, the threat actors have designed the fake phishing website perfectly with all the elements that are present in the genuine website.

Here below we have mentioned other two key aspects that the threat actors have mimicked from the original one to make the fake website more authentic:-

  • Subscription page
  • Career section with fake jobs opening

Technical analysis

The Mitsu Stealer was created using the Python programming language. The stealer performs the following illicit actions when it is executed:-

  • Drops the python supporting files (e.g. “.pyd” & “.dll” files)
  • Steals sensitive information
  • Deletes them after successful execution

Upon installation of the malware, it will now create a list of the processes running on the computer system of the user. In order to determine the names of the processes associated with the network analysis tool, the program examines the names of the processes.

Now to replace the API/webhooks with MitsuTheGoat, the malware circumvents the BetterDiscord. Thereafter, from the infected system of the victim the stealer collects all the sensitive data like:-

  • Usernames
  • Passwords
  • Cookies
  • Auto-fills
  • User profiles

The malware also targets cryptocurrency wallets and other wallets to steal financial information and abuse them for financial gains. For data extraction following SQL queries are used by the malware:-

  • SELECT host_key, name, encrypted_value FROM cookies
  • SELECT action_url, username_value, password_value FROM logins

Targeted browsers

Here below we have mentioned all the web browsers targeted by the stealer to steal user data:-

  • Google Chrome
  • Microsoft Edge
  • Opera GX Stable
  • Opera Stable
  • Mozilla Firefox

In order to collect Discord tokens, the malware reads and extracts the following files from a variety of locations across the system:-

  • .log
  • .ldb

The malware then creates a JSON dump that sends the stolen data to a Discord webhook. Afterward, the stealer downloads a JavaScript file called index.js in order to conduct the illicit activity that the threat actors want.


Here below we have mentioned all the recommendations:-

  • Make sure you do not download tools or software that is pirated.
  • Passwords should be strong
  • Multi-factor authentication should be implemented
  • Activate the automatic software update feature
  • Make sure you use a reputable antivirus program
  • Do not open untrusted links or attachments in emails
  • Enable DLP Solutions

Also Read: Download Secure Web Filtering – Free E-book


Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles