Kematian Stealer has emerged as a sophisticated PowerShell-based malware that secretly exploits sensitive data from compromised systems.
This article delves into the complex workings of this malware, highlighting its methods and the potential risks it poses.
Binary Analysis
Kematian Stealer starts its operation with a portable 64-bit executable file, written in C++. This loader contains an obfuscated script in its resources, designed to evade detection and analysis. Upon execution, the malware extracts a blob with the identifier “112E9CAC33494A35D3547F4B3DCD2FD5” from its resources, according to a report by K7 Labs.
See also: Mac users exposed to info-stealer malware via Google Ads
This blob is then decrypted, revealing a batch file that initiates the next phase of the attack. The decryption process, likely using the RC4 algorithm, is a critical step in the malware’s execution flow. Once decrypted, the batch file is executed with elevated privileges, ensuring that the subsequent PowerShell script can run without hindrance. This script checks for administrator privileges and, if necessary, prompts the user before creating a persistence via the Windows Task Scheduler.
Persistence and Data Collection
Kematian Stealer's persistence mechanism involves creating a copy of a PowerShell script in the %Appdata% folder named percs.ps1. This script is scheduled to run regularly, ensuring the malware's continued presence on the infected system.
The essence of the data extraction process lies in the “grub” function, which collects extensive system information via the public IP address, which is obtained from a web request to “https://api.ipify.org”. The IP is recorded in a text file named “ip.txt” in the user’s local application data directory.
The malware then collects detailed system information using the Windows command-line tool, Systeminfo.exe. This includes the operating system, hostname, system model, and more, which are recorded in “system_info.txt.”
Additionally, the malware extracts the system's UUID and MAC addresses via Windows Management Instrumentation (WMI) and stores this information in files named “uuid.txt” and “mac.txt”, respectively.
Network and user information
Kematian Stealer extends its data collection capabilities by running NETSTAT.exe to obtain network statistics, retrieving active connections, listening ports, and associated process IDs. This information is critical for understanding the network environment of the compromised system.
Additionally, system environment variables gather user and host information, providing the hacker with valuable data about the system’s user profile. The collected data is meticulously formatted and sent to a Discord channel via webhook, ensuring that the hacker receives a complete report of the victim’s system.
Read more: Hackers develop Hijack Loader and Vidar Stealer
Data Export
The final stage of Kematian Stealer's operation involves extracting the collected data. The malware compresses all text files into a zip archive and uses Curl.exe to transfer the data and a JSON payload to a pre-defined Discord channel.
This method leverages Discord 's infrastructure for encrypted communication, making detection and eavesdropping more difficult.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
To avoid detection, the malware checks for the presence of security tools, such as Discord Token Protector, and removes them if it finds them.
It also attempts to download additional payloads from Kematian Stealer's GitHub page, although some URLs redirect to older versions.
Kematian Stealer is a prime example of the increasing sophistication of modern malware.
With features such as GUI creation, antivirus evasion, and the ability to extract WiFi, webcam data, desktop snapshots, and session data from various clients, it poses a significant threat to both consumers and businesses.
See more: Fake browser updates distribute BitRAT and Lumma Stealer malware
The Kematian Stealer's abuse of PowerShell for covert data extraction highlights the imperative need for continuous improvement in cybersecurity.
By understanding the tactics and techniques used by malware, we can better prepare and protect ourselves more effectively.
IoCs
Source: cybersecuritynews
