Security News Vega Stealer Malware Takes Aim at Chrome, Firefox

[LASER_oneXM]

Content source

https://threatpost.com/vega-stealer-malware-takes-aim-at-chrome-firefox/131924/

Vega Stealer Malware Takes Aim at Chrome, Firefox

A malware dubbed Vega Stealer has been uncovered, looking to make off with saved credentials and credit-card information in the Chrome and Firefox browsers. While it’s a simple payload for now, researchers said it has the ability to evolve into something more concerning in the future.

Proofpoint, which was first to observe the bad code making the rounds in the cyber-firmament, said the malware is a variant of August Stealer. It has a subset of the parent malware’s functionality as well as additional features.

In addition to stealing browser data, Vega shares the ability to exfiltrate Word, Excel, PDF and text files from an infected machine, just as August does (Proofpoint pointed out that August however does not have this hard-coded in the malware, but rather configurable in the C&C panel). Also, the Chrome browser stealing functionality in Vega is a subset of the August code; August also stole from other browsers and applications, such as Skype and Opera.

Vega’s new functionality includes new network communication protocol and expanded Firefox stealing functionality.

 

[upnorth]

Researchers at Proofpoint saw Vega being delivered via a low-volume email campaign, with subjects such as “Online store developer required,” spamming individuals as well as distribution lists. The messages contained a malicious attachment called “brief.doc,” with macros that download Vega. Interestingly, the observed campaign has fairly narrow targeting: It’s taking aim at the marketing, advertising and public relations sector, along with retail and manufacturing. Researchers said that the macros retrieve the payload in a two-step process: The document executes a request that retrieves an obfuscated JScript/PowerShell script. The execution of that script then creates a second request, which downloads the Vega Stealer payload to the user’s music directory. The malware is then executed automatically via the command line.

Vega is written in .NET, and the sample observed dropping in the wild does not contain any packing or obfuscation methods.