At present, the Vega
Stealer is just being utilized as a part of small phishing campaigns, however
researchers believe that the malware can possibly bring about major
hierarchical level attacks as it is just another variation of August Stealer
crypto-malware that steals credentials, sensitive documents, cryptocurrency
wallets, and different subtle elements put away in the two browsers.
On May 8 this year, the researchers observed and obstructed
a low-volume email campaign with subjects, for example, 'Online store developer
required'. The email comes with an attachment called 'brief.doc', which
contains noxious macros that download the Vega Stealer payload.
The Vega Stealer ransomware supposedly focuses on those in
the marketing, advertising, public relations, and retail/ manufacturing industries.
Once the document is downloaded and opened, a two-step download process begins.
The report said
"...The first request executed by the document retrieves an obfuscated
JScript/PowerShell script. The execution of the resulting PowerShell script
creates the second request, which in turn downloads the executable payload of
Vega Stealer, the payload is then saved to the victim machine in the user's
"Music" directory with a filename of 'ljoyoxu.pkzip' and once this
file is downloaded and saved, and it is executed automatically via the command
line."
At the point when the Firefox browser is in utilization, the
malware assembles particular documents having different passwords and keys, for
example, "key3.db" "key4.db", "logins.json", and
"cookies.sqlite".
Other than this, the malware likewise takes a screenshot of
the infected machine and scans for any records on the framework finishing off
with .doc, .docx, .txt, .rtf, .xls, .xlsx, or .pdf for exfiltration.
While the researchers couldn't ascribe Vega Stealer to any
particular group, regardless they guarantee that the document macro and URLs
associated with the crusade propose that a similar threat actor is responsible
for campaigns spreading financial malware.
So as to be protected, Ankush Johar, Director at Infosec
Ventures, in a press statement said that "...Organisations should take
cyber awareness seriously and make sure that they train their consumers and
employees with what malicious hackers can do and how to stay safe from these
attacks. One compromised system is sufficient to jeopardize the security of the
entire network connected with that system."
Because while Vega Stealer isn't the most complex malware in
use today, but it does demonstrates the adaptability and flexibility of
malware, authors, and actors to accomplish criminal objectives.
