Our Malware Lab conducted an in-depth analysis on DivulgeStealera family of malware belonging to the 'stealer' category, actively promoted in dark web forums. The first version of the builder is freely available on GitHub, however, various searches have revealed the limited availability of technical reports on the analysis of this family. Therefore, we aim to contribute with up-to-date reporting, providing the latest technical evidence on DivulgeStealer.
The infection analysed by the team originates from a Microsoft Word document containing a malicious VBA macro. When the file is opened, the macro starts the second stage of the infection, downloading a ZIP archive containing a Batch script from a remote server. The latter is extracted and executed automatically.
The script is designed to generate an executable from internally encoded content, thus completing the third and final stage of the infection chain.
The decoded executable was, in fact, identified as DivulgeStealera malware developed in .NET, capable of exfiltrating Discord accounts, browser credentials and cryptocurrency walletsby sending the information to a Discord server controlled by the attacker, used as a command and control channel (C2).
If you wish to learn more, here is the link to our full report.
In addition, you can subscribe to the specific mailing list Cyber Studios by Tinexta Defence, to receive updates on upcoming research: https://tinextadefence.it/mailing-list-cyber-studios/
