ArmorSteal Malware Spreads via Fake Software Downloads, Targeting Credentials and Crypto
Attackers are distributing the Python-based ArmorSteal malware through deceptive websites impersonating popular software download platforms, aiming to steal credentials, cryptocurrency, and Discord accounts.
Cybercriminals are actively distributing a sophisticated Python-based malware kit known as ArmorSteal, leveraging fake software download websites to ensnare unsuspecting users. These malicious sites are designed to mimic legitimate platforms like the Chocolatey package manager and Microsoft Activation Scripts, tricking individuals searching for installation instructions into downloading the malicious payload. Researchers at Seqrite Labs and Zscaler ThreatLabz have detailed how these fake domains, such as choclatey[.]org and massgravel[.]net, present users with seemingly harmless PowerShell commands that, while potentially installing the intended software, also surreptitiously drop the ArmorSteal malware into a disguised system folder.
The infection chain is designed for stealth and persistence. Once deployed, ArmorSteal establishes itself using multiple scheduled tasks, including 'SysCheck2', 'SysCheckX', and 'SysHeal', all pointing to its hidden installation directory. Crucially, the malware bundle includes its own Python 3.11 runtime, ensuring it can execute on any Windows system without requiring a pre-installed Python environment. The scripts are obfuscated using a trial version of PyArmor, making direct analysis difficult, though researchers have found methods to unpack them.
ArmorSteal employs a multi-layered command and control (C2) infrastructure, with each component maintaining its own list of servers. This design ensures that disabling one process does not cripple the entire operation. The malware generates a unique victim ID based on the machine's motherboard serial number and attempts to connect to a list of 11 potential C2 domains sequentially. This approach makes blocking the entire botnet challenging, as attackers can easily shift to backup domains.
To evade detection by security solutions, ArmorSteal incorporates several advanced techniques. It first checks the network owner via ipinfo.io; if the connection originates from major cloud providers like Google, Amazon, or Azure, it aborts execution, effectively bypassing many sandbox environments. Furthermore, all commands and payloads are signed with the attacker's RSA-2048 private key, preventing unauthorized takeover of the botnet even if a C2 domain is compromised.
The malware's payload includes a Monero cryptocurrency miner, xmrig, which is downloaded and executed. To hide its activity, ArmorSteal adds an exclusion for the entire C:\Windows directory in Windows Defender's scan settings, a persistent measure that remains even after the malware is removed. The miner also exhibits sophisticated anti-monitoring behavior, shutting down if it detects common analysis tools like Task Manager, Process Explorer, or Wireshark, only to restart moments after the tool is closed.
Beyond cryptocurrency mining, ArmorSteal functions as a potent information stealer. Its 'spy' module, basrq.py, logs keystrokes and captures window titles to associate them with specific websites, aiding in credential theft. It also actively monitors the clipboard, replacing copied cryptocurrency wallet addresses with those belonging to the attackers, supporting nine different address types. The malware can also capture screenshots when specific keywords are detected and displays fake wallet deposit notifications to trick users into revealing their private keys.
Further enhancing its data exfiltration capabilities, ArmorSteal targets Discord tokens from multiple applications and browsers, allowing attackers to hijack accounts without needing passwords or two-factor authentication. It also extracts data from numerous browser-based and desktop cryptocurrency wallets, and scans drives for BIP-39 seed phrases. The malware utilizes tools like ChromElevator to bypass browser security measures and targets password managers such as 1Password, Bitwarden, and Dashlane.
Security professionals are advised to look for behavioral indicators rather than relying solely on file hashes, which change with each PyArmor rebuild. Key indicators include Python processes running from unusual locations, scheduled tasks named 'SysCheck2', 'SysCheckX', or 'SysHeal', and the addition of Windows Defender exclusions for C:\Windows. Users are strongly cautioned against executing PowerShell commands obtained from search engine results and should always navigate to official websites directly. Anyone who may have run such commands should assume their credentials, tokens, and wallet seeds are compromised and take immediate steps to secure their accounts from a trusted device.