Beware of Bandit Stealer Targets Crypto Wallets

Cybersecurity researchers have picked apart a newly discovered stealthy malware named Bandit Stealer, which possesses the ability to target a wide range of web browsers and cryptocurrency wallets. This malware has gained notoriety due to its utilization of the Go programming language, suggesting the potential for cross-platform compatibility, as stated in a report by Trend Micro.

Currently, Bandit Stealer primarily focuses on Windows systems, employing a legitimate command-line tool called runas.exe. This tool enables users to execute programs under different user accounts with varying permissions. By leveraging this tool, the malware aims to escalate privileges and run with administrative access, effectively evading security measures and extracting significant amounts of data.

It is worth noting, however, that Microsoft has implemented access control mitigations to prevent unauthorized execution of runas.exe. Therefore, running the malware binary as an administrator necessitates providing the appropriate credentials.

Trend Micro elaborates on the runas.exe command, highlighting its usefulness in running critical applications or performing system-level tasks under an administrator or another user account with adequate privileges. This becomes particularly valuable when the current user account lacks the necessary permissions to execute specific commands or programs.

Bandit Stealer incorporates mechanisms to detect if it is operating within a sandbox or virtual environment. Additionally, it terminates a list of blacklisted processes to conceal its presence on the victim system effectively. Before commencing its data collection activities, which involve harvesting personal and financial information from web browsers and cryptocurrency wallets, the malware establishes persistence by modifying the Windows Registry.

Distribution Methods

The distribution of Bandit Stealer is accomplished through phishing emails that contain a dropper file. This file opens a seemingly harmless Microsoft Word attachment as a distraction while silently initiating the infection process in the background.

Trend Micro also identified a counterfeit Heart Sender installer, a service that automates the sending of spam emails and SMS messages to multiple recipients. This installer serves as a deceptive tactic, tricking users into launching the embedded malware.

In a relatively uncommon tactic, the malware achieves persistence by modifying the installed Discord client, injecting JavaScript code that captures information from the application.

Another emerging trend is the utilization of compromised YouTube channels with millions of subscribers to advertise cracked software, resulting in data breaches. These stolen data can be exploited by the perpetrators for various purposes, such as identity theft, financial gain, credential stuffing attacks, and account takeovers.