New Editbot Stealer in Action; Stealing Browser Passwords & Cookies

A brand recent malicious advertising and marketing and marketing and marketing campaign, Editbot Stealer, used to be discovered wherein threat actors utilize WinRAR archive info with minimal detection to originate a multi-stage assault. Risk actors had been the utilization of the theme of “atrocious product to be sent back” to entice users to their false web sites.

On the opposite hand, the malicious WinRAR archive pale by the threat actors contains a .bat file and a JSON file for initial stage assaults, adopted by some Powershell commands for additional stages. The distribution of these malicious info used to be accomplished via social media.

Editbot Stealer in Movement

Initial Gain entry to & Persistence

In line with the studies shared with Cyber Safety News, the BAT file pale in the initial stages of the assault goes by the title “Screenshot Product Photo Sample.bat” containing a few Powershell commands for downloading and executing additional payloads.

The main PowerShell declare within the BAT file downloads any other BAT file from Gitlab and saves it below the title “WindowsSecure.bat” in the startup folder for chronic execution. This BAT file is pale to customarily attain the Python stealer, which is downloaded later in the assault stage.

The second PowerShell declare retrieves a ZIP file named “File.zip” from the the same GitLab repository and saves it in the C:CustomersPublic list. The third powershell declare extracts this ZIP file into the C:CustomersPublicPaperwork list containing the python stealer “libb1.py”.

Working of the Python Stealer – Editbot

The Python stealer contains sophisticated programming code that performs lots of functions, including extracting the country code, IP address, and timestamp of the victims, alongside with the credential-stealing actions linked to lots of browsers.

This stealer extracts a few gadgets of data, equivalent to cookies, login data, web data, and local divulge, from the browser profile folder and retail outlets them within the %temp% folder. The whole stolen info is saved in a textual scream file named “budge.txt”.

After amassing the general info from the sufferer, the stealer creates a ZIP archive of the general extracted info and retail outlets them within the the same %temp% list. To exfiltrate this info, the threat actors relish living up telegram bots.

Furthermore, a whole document referring to the Editbot stealer has been printed, which presents detailed info on the source code, extraction blueprint, and other info.

Indicators of Compromise