New RedLine Stealer Variant Disguised as Game Cheats Using Lua Bytecode for Stealth

A new details stealer has been observed leveraging Lua bytecode for added stealth and sophistication, results from McAfee Labs reveal.

The cybersecurity organization has assessed it to be a variant of a regarded malware identified as RedLine Stealer owing to the fact that the command-and-manage (C2) server IP handle has been previously recognized as affiliated with the malware.

RedLine Stealer, first documented in March 2020, is generally delivered via email and malvertising campaigns, both specifically or by way of exploit kits and loader malware like dotRunpeX and HijackLoader.

The off-the-shelf malware is able of harvesting information from cryptocurrency wallets, VPN program, and web browsers, such as saved credentials, autocomplete information, credit history card info, and geolocations primarily based on the victims’ IP addresses.

About the several years, RedLine Stealer has been co-opted by quite a few danger actors into their attack chains, producing it a common strain spanning North The us, South America, Europe, Asia, and Australia.

The infection sequence discovered by McAfee abuses GitHub, employing two of Microsoft’s official repositories for its implementation of the C++ Normal Library (STL) and vcpkg to host the malware-laden payload in the type of ZIP archives.

It’s at present not known how the documents arrived to be uploaded to the repository, but the approach is a sign that risk actors are weaponizing the believe in affiliated with reliable repositories to distribute malware. The ZIP documents are no for a longer period readily available for obtain from the Microsoft repositories.

The ZIP archive (“Cheat.Lab.2.7.2.zip” and “Cheater.Pro.1.6..zip”) masquerades as a video game cheat, indicating that avid gamers are probable the target of the marketing campaign. It will come fitted with an MSI installer that’s built to run the destructive Lua bytecode.

“This approach gives the gain of obfuscating malicious stings and keeping away from the use of very easily recognizable scripts like wscript, JScript, or PowerShell script, thereby maximizing stealth and evasion capabilities for the threat actor,” researchers Mohansundaram M. and Neil Tyagi reported.

In an try to move the malware to other methods, the MSI installer displays a information urging the target to share the software with their friends in order to get the unlocked variation of the software package.

The “compiler.exe” executable in the installer, on jogging the Lua bytecode embedded within the “readme.txt” file existing in the ZIP archive, sets up persistence on the host utilizing a scheduled job and drops a CMD file, which, in convert, operates “compiler.exe” beneath a further title “NzUw.exe.”

In the closing stage, “NzUw.exe” initiates communications with a command-and-management (C2) server more than HTTP, the aforementioned IP handle attributed to RedLine.

The malware functions far more like a backdoor, carrying out jobs fetched from the C2 server (e.g., getting screenshots) and exfiltrating the final results back to it.

The actual approach by which the hyperlinks to the ZIP archives are distributed is presently unknown. Before this thirty day period, Checkmarx revealed how threat actors are using advantage of GitHub’s research features to trick unsuspecting buyers into downloading malware-laden repositories.

The growth arrives as Recorded Foreseeable future specific a “big-scale Russian-language cybercrime operation” that singles out the gaming community and leverages phony Web3 gaming lures to provide malware capable of thieving sensitive data from macOS and Windows buyers, a strategy referred to as entice phishing.

“The marketing campaign will involve building imitation Web3 gaming tasks with slight name and branding modifications to show up respectable, along with phony social media accounts to bolster their authenticity,” Insikt Group stated.

“The major webpages of these initiatives offer you downloads that, after put in, infect products with several sorts of “infostealer” malware this kind of as Atomic macOS Stealer (AMOS), Stealc, Rhadamanthys, or RisePro, dependent on the operating program.”

It also follows a wave of malware campaigns focusing on business environments with loaders these as PikaBot and a new pressure known as NewBot Loader.

“Attackers demonstrated a varied assortment of approaches and infection vectors in each marketing campaign, aiming to produce the PikaBot payload,” McAfee explained.

This contains a phishing attack that can take advantage of email discussion hijacking and a Microsoft Outlook flaw referred to as MonikerLink (CVE-2024-21413) to entice victims into downloading the malware from an SMB share.

Located this article intriguing? Abide by us on Twitter  and LinkedIn to study much more exclusive written content we publish.

Some parts of this article are sourced from:
thehackernews.com