MASAD

DESCRIPTION OF EVENTS

"Masad Stealer is malicious software that, once installed, allows cyber criminals to steal various information/data. Its basic version is free, however, cyber criminals can purchase a 'full version' with more features for $85. Masad Stealer is available for download on hacking forums." "Previous versions of this malware (or possibly a direct ancestor) are called “Qulab Stealer”."

"The Masad Stealer is written in Autoit scripts and is compiled into a Windows executable. The size of most of the samples analyzed by the experts was about 1.5 MiB, but experts revealed that it is possible to find larger executables bundled into other applications." "The malware achieves persistence by creating a scheduled task on all Windows devices it manages."

"Based on our telemetry, Masad Stealer’s main distribution vectors are masquerading as a legitimate tool or bundling themselves into third party tools. Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites." "[B]rowser information, and cryptocurrency wallet data from infected computers get sent back to its masters using Telegram as a communication channel."

"Masad malware is mainly used to steal information stored on browsers (including passwords), cryptocurrency wallet data, and various files." "After installing itself, Masad Stealer starts by collecting sensitive information from the system, such as Cryptocurrency Wallets." "Masad Stealer is also able to automatically replaces Monero, Bitcoin Cash, Litecoin, Neo, and Web Money cryptocurrency wallets from the clipboard with its own."

"The malware is being advertised on black market forums as “Masad Clipper and Stealer.” It steals browser data, which might contain usernames, passwords and credit card information. Masad Stealer also automatically replaces cryptocurrency wallets from the clipboard with its own."

"Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites." "Victims can also get infected when installing various software and game cracks, cheats, and aimbots, which shows that the actors behind this malware don't mind adopting very well known infection vectors that have proven to be highly effective."

"Of the more than 1,000 samples we identified to be variants of this malware, there where 338 unique Telegram Command and Control bot IDs. From this data, we can estimate the number of threat actors – or at least the number of different campaigns being run using the Masad Stealer malware – and the size of their operations. We used the getMe API, along with the bot token, to identify the usernames."

Masad Clipper and Stealer is a new form of malware which can be obtained through a malicious download. The software can obtain inforamtion about installed cryptocurrency wallets and also modify addresses in the clipboard to intercept funds.

Masad Stealer: Exfiltrating using Telegram | Official Juniper Networks Blogs (Jan 29)
Masad Stealer - Malware removal instructions (updated) (Feb 2)
New Masad Stealer Malware Exfiltrates Crypto Wallets via Telegram (Feb 3)
Masad Stealer Malware exfiltrates data via TelegramSecurity Affairs (Feb 3)
Masad Stealer Preys on Telegram Users in Cryptocurrency Theft Campaign (Feb 3)
Telegram Malware Masad Steals Crypto Wallet Data and Modifies Addresses - CoolWallet (Feb 3)
Masad Spyware Uses Telegram Bots for Command-and-Control | Threatpost (Feb 3)
Remove Masad Trojan From Your PC (Feb 3)

More case studies

Coinbase Hack
Despite 2FA BradlyL

IconicsSOL NFT
Emojis Rug Pull