Doenerium Stealer Grabs Crypto, Other Information
Doenerium is a malicious information stealer disguised as Windows Malicious Software Removal Tool. It is designed to target cryptocurrency wallets, Internet browsers, clipboard data and system information in order to mine digital currencies on infected computers. This malware creates an exfiltration folder containing other folders and then searches for crypto wallets such as Armory, AtomicWallet, Bytecoin, Coinomi, Electrum, Ethereum, Guarda, Jaxx and Zcash. It stores any discovered wallets into a folder named "Wallets".
Furthermore, Doenerium steals Discord tokens and data from web browsers, including autofill data, bookmarks, cookies history passwords and wallets. Additionally, it contains a clipper module that scans the computer's clipboard for cryptocurrency wallet addresses. If any are found, they get replaced with the attacker's own address.
Once it collects all the data Doenerium compresses it into a ZIP archive and uploads it to a free file-sharing platform, after which it deletes both the ZIP file and exfiltration folder from the victim's computer. This way, attackers can keep their malicious activities hidden away on remote locations. All of these actions make Doenerium an especially dangerous information stealer that should be avoided at all costs.
