{"id":7288,"date":"2024-03-18T08:30:33","date_gmt":"2024-03-18T08:30:33","guid":{"rendered":"\/cybersecurity-blog\/?p=7288"},"modified":"2024-03-18T08:32:02","modified_gmt":"2024-03-18T08:32:02","slug":"asukastealer-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/asukastealer-malware-analysis\/","title":{"rendered":"AsukaStealer: The Next Chapter in ObserverStealer’s Story"},"content":{"rendered":"\n

The following research was conducted by Anna Pham, also known as RussianPanda, a Senior Threat Intelligence researcher and a guest author for the ANY.RUN Blog. For more of her expert insights, follow her on Twitter\/X<\/a>. Now, let’s get started with the analysis.<\/p>\n\n\n\n

On May 19, 2023, an individual known by the pseudonym ‘breakcore’ announced that AsukaStealer was available for sale at $80 a month. Developed in C++, AsukaStealer includes capabilities to deploy additional payloads on infected computers, configure FileGrabber settings, and facilitate log delivery via Telegram, among other features.<\/p>\n\n\n

\n
\"\"
Figure 1<\/em>: AsukaStealer sell announcement <\/em><\/figcaption><\/figure><\/div>\n\n\n

It\u2019s worth mentioning that breakcore used the pseudonym ObserverStealer before and was selling ObserverStealer on hacking forums until July 2023.<\/p>\n\n\n

\n
\"\"
Figure 2<\/em>: Username history on the hacking forum <\/em><\/figcaption><\/figure><\/div>\n\n\n

ObserverStealer failed to gain popularity among cybercriminals and received predominantly negative reviews. <\/p>\n\n\n

\n
\"\"
Figure 3<\/em>: Technical discussion thread on ObserverStealer (source: XSS forum) <\/em><\/figcaption><\/figure><\/div>\n\n
\n
\"\"
Figure 4<\/em>: WhiteSnake\u2019s comment on ObserverStealer <\/em><\/figcaption><\/figure><\/div>\n\n\n

In this write-up, we will dive into the analysis of AsukaStealer (MD5: 32583272b5b5bd95e770661438b41daf) to determine if it\u2019s the rebrand of ObserverStealer.<\/p>\n\n\n\n\n

\n\n

\nFollow along with the analysis in the ANY.RUN sandbox<\/span> \n<\/p>\n\n\nSign up for free\n<\/a>\n<\/div>\n\n\n\n