Researchers at ASEC - AhnLab Security Intelligence Center, have recently warned about the significant increase in computers infected with information-stealing malware like LummaC2 and ACR Stealer. According to the researchers, the reason these computers are infected is due to cracked software and keygens containing malicious content circulating online. The use of these illegal software and keygens by regular users has contributed to the increase in these numbers.

Figure 1: Website distributing cracked software containing hidden malware

ACR Stealer is information-stealing malware written in the C++ programming language. Appearing around early 2024, this malware targets regular users with computers running the Windows operating system. Promoted and developed under the Malware-as-a-Service (MaaS) model, this malware can steal sensitive information from the system, such as browser cookies, login information stored in web browsers, cryptocurrency wallets, configuration files of programs on the system, and information about the infected system, among others.

Additionally, the danger level of ACR Stealer is considered high due to its ability to evade detection by security solutions. Specifically, this malware uses the "dead drop resolver" (DDR) technique, a method where the malware exploits legitimate service servers like Steam, Telegram's Telegraph, Google Forms, Google Slides, etc., as intermediaries to access the actual C2 address, while also using Base64 encryption to transmit data over the communication channel.

Figure 2: Google Docs (Forms) exploited as an intermediary to connect to C2

The actual C2 domain obtained from the exploited servers, combined with a hardcoded UUID identifier, is used to download URLs containing configuration information. Analyzing the network behavior of this data reveals the amount of information the malware has collected on the victim's machine, as shown in the following image:

Figure 3: Network behavior analysis of the malware

ASEC researchers also provide an additional list of programs from which this malware steals information, specifically:

Recommendations

Along with the rapid development of information technology, dangerous malware like ransomware or information-stealing malware (Infostealer) has become increasingly unpredictable. To minimize the risk of facing these information security threats, the FPT Threat Intelligence team recommends:

• Enhance knowledge: Users should equip themselves with essential knowledge about cybersecurity.

• Use legitimate software: Users should not use cracked software or illegal keygens of unknown origin.

• Browse safely: Users should avoid accessing unknown links advertised on social media platforms or embedded in strange emails.

• Use security services: Users should install antivirus software or use 24/7 monitoring services to enhance security.

IOCs

URLs

FQDN

Reference

1. ASEC report: https://asec.ahnlab.com/en/86390/