Check the status of CVEs. Learn More.
Keeping your systems up 100% of the time requires live patching. Our solutions will align strongly with your risk, compliance, and operational uptime requirements.
TuxCare is trusted by the most innovative companies across the globe.
Learn about TuxCare's modern approach to reducing cybersecurity risk with Blogs, White Papers, and more.
Continually increasing Cybersecurity, stability, and availability of Linux servers and open source software since 2009.
TuxCare provides live security patching for numerous industries. Learn how TuxCare is minimizing risk for companies around the world.
2x a month. No spam.
September 19, 2022 - TuxCare expert team
A backdoor in information stealing malware, Prynt Stealer is used to steal data that is exfiltrated by other cyberattackers, according to Zscaler ThreatLabz researchers.
Already, the malware sells for $100 for a one-month license and $900 for a lifetime subscription, offering attackers tremendous capabilities. These include the ability to log keystrokes, steal credentials from web browsers, and suck data from Discord and Telegram.
Prynt Stealer code comes from two other open source malware families, AsyncRAT and StormKitty. New additions to the malware include a Telegram channel that collects information stolen from other threat actors through a backdoor.
To perform the data exfiltration, Prynt Stealer uses code copied from StormKitty with minor changes. The malware also includes an anti-analysis feature that equips the malware to continuously monitor the victim’s process list for processes such as taskmgr, netstat and wireshark,
As soon as the victim’s process list is detected, the malware blocks the Telegram command and control channels.
The researchers also identified two other variants of the malware written by the author of the malware, Prynt Stealer: WorldWind and DarkEye.
DarkEye is an implant with a free Prynt Stealer builder. The builder is designed to drop and execute a remote access trojan called Loda RAT, an AutoIT-based malware that can access and exfiltrate both system and user information. DarkEye also acts as a keylogger, takes screenshots, starts and terminates processes, and downloads additional malware payloads over a connection to a C2 server.
“While this untrustworthy behavior is nothing new in the world of cybercrime, the victims’ data end up in the hands of multiple threat actors, increasing the risks of one or more large-scale attacks to follow. Note that there are cracked/leaked copies of Prynt Stealer with the same backdoor, which in turn will benefit the malware author even without direct compensation,” write Zscaler ThreatLabz researchers Atinderpal Singh and Brett Stone-Gross.
The sources for this piece include an article in TheHackerNews.
Learn About Live Patching with TuxCare
Malicious hackers have started exploiting a critical vulnerability CVE-2022-44877 in...
Deep Instinct researchers reported that RATs like StrRAT and Ratty...
According to CircleCI’s CTO, Rob Zuber, CircleCI is working with...
A remote attacker could exploit multiple vulnerabilities in four Cisco...
In a notable IcedID malware attack, the assailant impacted the...
Bitdefender experts have created a universal decryptor for victims of...