Mini Stealer: Possible Predecessor Of Parrot Stealer

guest · Sep 3, 2022

Cybercriminals Released Mini Stealer’s Builder & Panel for Free on a Cybercrime Forum
By Gurubaran S - August 31, 2022

A threat actor has recently released MiniStealer’s builder and panel for free on a cybercrime forum. Cyble Research and Intelligence Labs (CRIL) security analysts discovered this exploit during a routine threat hunting exercise carried out recently.

Threat actors can easily create malicious payloads using such builders, which can make them easy for them to generate. There is a lot of stuff that MiniStealer targets, but it mostly targets FTP applications and browsers that are based on Chromium.
Click to expand...

The same threat actor made a post sometime after the release of MiniStealer, where he sold the builder and panel for Parrot Stealer for the price of USD 50.

As stated in the report by the threat actor, this stealer is a modified version of MiniStealer. It is possible that the threat actor had added functionality in Parrot stealer that wasn’t present in MiniStealer.
Click to expand...

Cyble: Mini Stealer: Possible Predecessor Of Parrot Stealer

Mini Stealer’s Builder & Panel Released For Free
During a routine threat hunting exercise, Cyble Research and Intelligence Labs (CRIL) discovered a post on a cybercrime forum where a Threat Actor (TA) released MiniStealer’s builder and panel for free.

The TA claims that the stealer can target operating systems such as Windows 7, 10, and 11. Using such builders, TAs can easily generate malicious payloads. MiniStealer mainly targets FTP applications and Chromium-based browsers.
Click to expand...

The builder released by the TA is a .NET-based binary. It has the functionality to add the Command and Control (C&C) details to the payload. The builder loads a file named “stub,” which is the actual payload, and then writes the C&C details to it for generating the final payload.
Click to expand...

Conclusion
The availability of free malware builders and panels can assist TAs in carrying out attacks, as TAs do not need to invest time and money to get malware payloads for cybercrime purposes. There is always the possibility that TA might have released the builder and panel of MiniStealer for free for marketing purposes and to build a reputation amongst themselves on cybercrime forums.

The TA’s behavior further reinforces this theory as after 1 month; they began selling a paid stealer, which is suspected to be based on MiniStealer. CRIL continuously monitors emerging threats and has observed a surge in the use of stealer malware by TAs.
Click to expand...

Log in or Sign up

Mini Stealer: Possible Predecessor Of Parrot Stealer

guest Guest

Log in or Sign up

Mini Stealer: Possible Predecessor Of Parrot Stealer

guest Guest

Useful Searches