Agniane Stealer: Dark Web’s Crypto Threat

MITRE Techniques

• [T1555.003] Credentials from Web Browsers – Steals stored browser credentials and cookies from Chromium/Gecko browsers and targets browser crypto extensions/wallets: ‘Supports stealing passwords and cookies from browsers based on Chromium and Gecko.’
• [T1041] Exfiltration Over C2 Channel – Uploads archived stolen data to a remote C2 server via HTTP POST: ‘Agniane Stealer uploads all the exfiltrated data to: hxxps[:]//central-cee-doja.ru/TEST.php?…’
• [T1071.001] Application Layer Protocol: Web Protocols – Uses HTTP/HTTPS POST requests for C2 communication and file transfer to the host: ‘POST Request Host Name ZIP file payload PK header indicates the transmission of an archive file.’
• [T1497] Virtualization/Sandbox Evasion – Detects debuggers, sandboxes, emulators and analysis tools and exits if found: ‘The malware sample calls the CheckRemoteDebuggerPresent Windows API to check if it’s being run in a debugger.’
• [T1027] Obfuscated Files or Information – Uses packers and ConfuserEx to obfuscate and harden builds, complicating analysis: ‘the latest version of the Agniane Stealer uses ConfuserEx Protector.’
• [T1047] Windows Management Instrumentation – Uses WMI queries to detect VMs and to collect system details (OS, GPU, CPU): ‘Agniane Stealer utilizes the WMI queries to detect whether it is running inside a virtual environment.’
• [T1113] Screen Capture – Captures screenshots of the user’s desktop for additional reconnaissance: ‘Saving screenshots from all monitors with detailed information about them.’
• [T1105] Ingress Tool Transfer – Downloads SQLite dependency DLLs from the C2 to enable runtime capabilities: ‘Agniane Stealer downloads the SQLite dependency DLL.’
• [T1070] Indicator Removal on Host – Removes local staging folder after successful exfiltration to delete traces: ‘After uploading the stolen data to a remote server, the Agniane Stealer removes its traces from the victim’s system by deleting the sub-folder.’
• [T1083] File and Directory Discovery – Enumerates Desktop and Documents folders to collect files with specific extensions (.txt, .doc, .rdp, .db): ‘Agniane Stealer enumerates the users Desktop and the Documents folder for the files with .txt,.doc,.mafile,.rdp, and .db extension.’
• [T1082] System Information Discovery – Gathers OS version, bitness, external IP, installed applications, CPU/GPU and RAM using WMI and registry queries: ‘Agniane Stealer gets the external IP address… collects victims Windows version using SELECT * FROM win32_operatingsystem.’
• [T1552.001] Unsecured Credentials: Credentials in Files – Extracts session/credential data from WinSCP registry entries and FileZilla recent servers XML: ‘pilfers WinSCP to collect Hostname, username, and password… reads FileZillarecentservers.xml and searches for the tag.’
• [T1518.001] Security Software Discovery – Queries installed antivirus products via WMI to decide execution flow: ‘Collects all installed antivirus software with the WMI query Select * from AntivirusProduct.’
• [T1036] Masquerading – Uses legitimate DLL handles obtained via GetModuleHandle to obscure its presence: ‘Agniane Stealer tries to obtain the handle of several DLLs using the GetModuleHandle function.’