ExelaStealer: Emerging Information Stealer Cyberweapon

Wajahat Raja

October 31, 2023 - TuxCare expert team

In the ever-evolving landscape of cybersecurity threats, a new information stealer has emerged known as ExelaStealer. This latest addition to the array of malicious software is causing a stir, targeting sensitive data on compromised Windows systems. This blog delves into the key aspects of this information stealer cyberweapon, shedding light on its capabilities, distribution, impact, and the broader context of cyber threats.

Information Stealer Cyberweapon: An Introduction

Cyber espionage tools are becoming increasingly sophisticated, posing a growing threat to digital security. ExelaStealer distinguishes itself as an open-source information stealer, with the option for paid customizations available from the threat actor, as revealed by Fortinet FortiGuard Labs researcher James Slaughter.

Written in Python and equipped with JavaScript support, this malware possesses a range of functionalities, making it a potent tool for cybercriminals. ExelaStealer specializes in gathering sensitive data, including passwords, Discord tokens, credit card information, cookies, session data, keystrokes, screenshots, and clipboard contents.

Accessibility and Affordability

One striking feature of ExelaStealer is its affordability. This data theft cyberweapon is readily available for purchase on cybercrime forums and a dedicated Telegram channel operated by a group using the online alias “quicaxd.” The pricing structure for this malware is astonishingly low, with options of $20 per month, $45 for three months, or a lifetime license for $120. This cost-effectiveness is making ExelaStealer an attractive choice for cyber novices, thereby lowering the entry barrier for malicious attacks.

The Challenge of Analysis

ExelaStealer presents a challenge for cybersecurity experts. The malware’s binary form can only be compiled and packaged on a Windows-based system using a builder Python script. This approach incorporates source code obfuscation, making it challenging to analyze and thwart the threat.

Distribution and Intrusion Techniques

ExelaStealer is being disseminated through various channels, and its initial intrusion vector is diverse. The malware often disguises itself as a PDF document, suggesting that potential victims could encounter it through tactics such as phishing or watering hole attacks.

When executed, the binary displays a deceptive document – in some instances, a Turkish vehicle registration certificate for a Dacia Duster – all the while discreetly launching the information-stealing process in the background.

The Value of Stolen Data

James Slaughter aptly describes data as the “currency” of the digital age. Information-stealing malware like ExelaStealer poses a significant threat, as it harvests data from both corporations and individuals. This ill-gotten data can subsequently be used for blackmail, espionage, or ransom. In a landscape filled with information stealers, ExelaStealer’s emergence highlights the ongoing demand for such tools and the potential for new entrants to gain traction.

A Broader Perspective

The unveiling of ExelaStealer aligns with recent revelations from Kaspersky, which exposed a campaign targeting government, law enforcement, and non-profit organizations. This campaign involved the deployment of multiple scripts and executables, aiming to conduct cryptocurrency mining, steal data using keyloggers, and establish backdoor access to systems. Detecting information stealer cyberweapons requires advanced security measures and constant vigilance.

The business sector remains a lucrative target for cybercriminals. The recent joint advisory from U.S. cybersecurity and intelligence agencies emphasized the common phishing techniques employed by malicious actors. These techniques involve impersonating trusted sources to obtain login credentials and deliver malware.

The advisory highlighted the diverse geographic locations where such attacks are prevalent, including Russia, Saudi Arabia, Vietnam, Brazil, Romania, the United States, India, Morocco, and Greece.

Conclusion

ExelaStealer’s emergence is a stark reminder of the constantly evolving threat landscape in the digital realm. This information stealer malware underlines the persistent need for vigilance and strict cybersecurity measures. As we navigate this challenging landscape, individuals, organizations, and governments must remain committed to defending against these ever-adapting cyber threats. In this digital age, protecting against data theft cyberattacks has become paramount. Understanding the security gap and the tools and techniques employed by malicious actors is a crucial step toward a more secure online environment.

The sources for this piece include articles in The Hacker News and Malware Tips.

Summary