Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer

It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only collects information stored in browsers and business applications but can also install additional malware, raising the possibility of secondary damage beyond mere Information Theft. Let’s take a look at the distribution methods, key behaviors, and countermeasures for this new type of Infostealer.

Expanded Distribution Through Changes in Execution Methods

The newly identified Infostealer was distributed disguised as illegal software, and some instances were found to be executed via a separate downloader.

The execution method also varied depending on the timing of distribution. Initially, there were small-scale distributions, presumably for testing purposes, which utilized AutoIt, a Windows automation scripting tool. Subsequently, the method shifted to process injection—where malware is injected into the Windows Explorer process to execute—or to standalone execution. Following such changes, large-scale distribution began in earnest in early September.

As such, since the execution method of this Infostealer varies depending on the distribution timing and the specific sample, it is necessary to examine not only the detection of specific executable files but also abnormal code injection behavior occurring within legitimate processes.

[Figure 1] Example of a distribution page

Various Evasion Techniques to Conceal Malicious Behavior

This infostealer was developed using the Rust programming language and employs several techniques to make it difficult to understand the malware’s internal structure and execution process. Notable examples include anti-disassembly using dynamic JMPs, anti-sandbox techniques leveraging CPU memory cache lookups, and DLL injection. These are techniques not commonly seen in previous Infostealers.

• Anti-Disassembly: A technique that interferes with the process of converting the malware’s machine code into analyzable code

• Anti-Sandbox: A method that detects whether the malware is running in an isolated analysis environment and hides its malicious behavior if it determines it is in such an environment

In fact, if this Infostealer determines that the execution environment is a sandbox or virtual environment, it terminates without performing any Information Theft. At that point, it displayed the message: “I love stealing cookies, but not on this machine. Sorry!” In some recently distributed samples, a technique was used where a DLL file stored internally in an encrypted state was decrypted and then injected into the Explorer process.

[Figure 2] Message box displayed when a VM environment is detected

The method used to hide strings is also distinctive. All strings referenced internally are stored in an encrypted state and decrypted only immediately before use. The decryption process uses a modified index table, and the table’s structure varies from one distributed sample to another.

Furthermore, the index table is modified once more by rotating it using the integer value passed when the decryption function is called as a key. As a result, even the same plaintext string can be encrypted in different forms depending on the encryption key used. Furthermore, an arbitrary string is appended to the end of the encrypted string to make it difficult to infer the length of the original string.

[Figure 3] Modified Base64 index table

[Figure 4] Example of string decryption code

As such, this infostealer employs various obfuscation techniques and continuously modifies the methods it uses depending on the distribution timing and the specific sample, making it even more difficult to understand its actual behavior.

Collecting PC Information and Information Theft According to C2 Instructions

When the Infostealer is executed, it first collects basic information about the infected PC and transmits it to a C2 server controlled by the threat actor. The collected data includes a list of installed programs, the CPU name, graphics driver information, data from the CPUID instruction, and the Windows operating system version.

It then receives configuration data from the C2 server and performs subsequent malicious behaviors according to those settings. In other words, the targets of information collection and additional execution tasks are determined based on the settings provided by the threat actor.

[Figure 5] Example of Configuration Data

The C2 communication process combines XOR encryption with the LZNT1 compression algorithm used in the Windows environment. Data transmitted to the C2 server is first encrypted using the XOR encryption method and then compressed using the LZNT1 algorithm, while data received from the server is decrypted using the XOR encryption method before being used. Additionally, the key values used for XOR encryption are set differently for each sample, which is presumed to be an attempt to evade detection based on network traffic analysis.

A notable aspect of this Infostealer is the extremely broad scope of its information collection targets. The confirmed C2 configuration data lists the following programs and files as targets for Information Theft: as follows:

• Web services and personal information: web browsers, instant messengers, email clients, password managers, note-taking applications

• Work and remote access environments: VPNs, remote access programs, database management tools, FTP and SSH tools

• Development and cloud environments: Cloud storage, AI and development tools

• Others: Cryptocurrency wallets, gaming platforms

• Key Files: Certificates, SSH keys, cryptocurrency wallet files, various configuration files, and document files

As shown here, caution is required because the threat actor targets not only account information stored in programs but also certificates, SSH keys, and document files themselves. In particular, if authentication credentials for VPNs or remote access programs are compromised, threat actors could exploit them to gain unauthorized access to a company’s internal systems or launch further attacks. However, the actual scope of information collection may vary depending on the settings transmitted by the C2 server.

Beyond Information Theft: Installation of Additional Malware

In addition to its Information Theft capabilities, this infostealer is also equipped with the ability to download and execute additional malware. It does this by connecting to an external URL specified in the settings received from the C2 server to download and execute an additional payload.

Malware that installs other malware in this manner is called a “dropper.” This Infostealer can also be used as a dropper to distribute other malware to infected systems. Analysis of the configuration data confirmed that the feature to download additional malware was enabled.

Therefore, this threat does not stop at the leakage of personal information; there is a possibility that the damage could escalate due to a Malware infection. If the stolen credentials are exploited in follow-up attacks, the impact could extend beyond individuals to affect corporate internal systems as well.

Preventing Infection and Checking for Signs of a Breach

This case demonstrates that malware infections through pirated software or cracked programs can lead to widespread Information Theft and the installation of additional malware. In particular, as the scale of malware distribution expands and evasion techniques continue to evolve, it is necessary to simultaneously implement infection prevention measures and monitor for suspicious behavior.

Users should download legitimate software from trusted sources, such as official websites. It is also important not to carelessly open compressed files or executable files from unknown sources.

Companies and organizations need to check whether there is a history of downloading large ZIP files from untrusted sources, decompressing them, and then running the executable files contained within. In particular, they should check for abnormal code injection behavior related to AutoIt.Exe or explorer.Exe, communication with suspicious C2 servers, and traces of Information Theft or the installation of additional malware.

In addition, organizations should utilize endpoint security solutions to monitor the execution of suspicious processes and external communications, and strengthen their threat detection and response systems based on identified indicators of compromise (IOCs).