UNKNOWN

SEPTEMBER 2021

GLOBAL

MASAD

DESCRIPTION OF EVENTS

"Masad Stealer is malicious software that, once installed, allows cyber criminals to steal various information/data. Its basic version is free, however, cyber criminals can purchase a 'full version' with more features for $85. Masad Stealer is available for download on hacking forums." "Previous versions of this malware (or possibly a direct ancestor) are called “Qulab Stealer”."

 

"The Masad Stealer is written in Autoit scripts and is compiled into a Windows executable. The size of most of the samples analyzed by the experts was about 1.5 MiB, but experts revealed that it is possible to find larger executables bundled into other applications." "The malware achieves persistence by creating a scheduled task on all Windows devices it manages."

 

"Based on our telemetry, Masad Stealer’s main distribution vectors are masquerading as a legitimate tool or bundling themselves into third party tools. Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites." "[B]rowser information, and cryptocurrency wallet data from infected computers get sent back to its masters using Telegram as a communication channel."

 

"Masad malware is mainly used to steal information stored on browsers (including passwords), cryptocurrency wallet data, and various files." "After installing itself, Masad Stealer starts by collecting sensitive information from the system, such as Cryptocurrency Wallets." "Masad Stealer is also able to automatically replaces Monero, Bitcoin Cash, Litecoin, Neo, and Web Money cryptocurrency wallets from the clipboard with its own."

 

"The malware is being advertised on black market forums as “Masad Clipper and Stealer.” It steals browser data, which might contain usernames, passwords and credit card information. Masad Stealer also automatically replaces cryptocurrency wallets from the clipboard with its own."

 

"Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites." "Victims can also get infected when installing various software and game cracks, cheats, and aimbots, which shows that the actors behind this malware don't mind adopting very well known infection vectors that have proven to be highly effective."

 

"Of the more than 1,000 samples we identified to be variants of this malware, there where 338 unique Telegram Command and Control bot IDs. From this data, we can estimate the number of threat actors – or at least the number of different campaigns being run using the Masad Stealer malware – and the size of their operations. We used the getMe API, along with the bot token, to identify the usernames."

Masad Clipper and Stealer is a new form of malware which can be obtained through a malicious download. The software can obtain inforamtion about installed cryptocurrency wallets and also modify addresses in the clipboard to intercept funds.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.