Enigma Stealer Malware Distributed Using Malspam

TrendMicro researchers recently uncovered an active campaign that is targeting Eastern Europeans in the cryptocurrency industry. The attackers are using a fake job pretext to install a modified version of the Stealerium information stealer, known as Enigma Stealer. In addition, they are exploiting CVE-2015-2291, an Intel driver vulnerability, to load a malicious driver which reduces the token integrity of Microsoft Defender.

Stealerium is an open-source project written in C# and is marketed as a stealer, clipper and keylogger with logging capabilities using the Telegram API.

The infection chain begins with a malicious RAR archive called contract.rar which is distributed via phishing attempts or social media. It contains two files; Interview questions.txt and Interview conditions.word.exe which set up the pretext for a fake cryptocurrency role or job opening. The former contains sample interview questions written in Cyrillic while the latter masquerades as a legitimate word document but actually contains the first stage Enigma loader. Once executed, it registers and downloads the second-stage payload.

Security teams and individual users should keep their security solutions updated and be aware of any suspicious job opportunity or salary increase lures from unknown sources.

What is infostealer malware, similar to the Enigma Stealer?

Infostealer malware is malicious software designed to steal sensitive information from a victim's computer, such as passwords, credit card numbers, and other personal data. It is similar to the Enigma Stealer in that it is used by threat actors to gain access to confidential information without the victim's knowledge or consent.

How do threat actors use social engineering and lures to slip malware through phishing?

Threat actors use social engineering and lures to slip malware through phishing by creating convincing pretexts that appear legitimate. This could include sending malicious emails or messages with attachments or links that appear to be from a trusted source, such as a job opportunity or salary increase. The malicious attachment or link will then download the malware onto the victim's computer, allowing the threat actor to gain access to confidential information without the victim's knowledge or consent.