⚠️ Overview

AmexTroll is an information-stealing trojan first documented in August 2023 by cybersecurity firm Cyble, operating as a malware-as-a-service (MaaS) platform targeting cryptocurrency wallet credentials and browser-stored data. It is written in Python and compiled with PyInstaller, marketed on underground forums by a threat actor known as "TrollDev," and primarily affects Windows systems.

🔧 Technical Capabilities

The malware exfiltrates data via Telegram bot API, using hardcoded chat IDs and tokens as its command-and-control mechanism. It targets browser databases (Chrome, Firefox, Edge) to steal saved passwords, cookies, and autofill data, and specifically extracts private keys from cryptocurrency wallet extensions such as MetaMask, Trust Wallet, and Atomic Wallet. Persistence is achieved by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for virtual machine environments via registry queries for HKLMSYSTEMCurrentControlSetServicesDiskEnum and terminating itself if detected. It also disables Windows Defender by modifying registry keys under HKLMSOFTWAREPoliciesMicrosoftWindows Defender and uses process hollowing to inject into legitimate processes like explorer.exe.

📜 History & Notable Incidents

First observed in August 2023, AmexTroll was linked to campaigns targeting cryptocurrency users in Southeast Asia and Latin America. Cyble's report (August 22, 2023) noted the malware was distributed via phishing emails containing password-protected ZIP archives disguised as invoices or order confirmations. No CVEs are directly attributed, but the malware exploits weak user password hygiene and lack of multi-factor authentication. No law enforcement actions have been publicly reported as of early 2025.

🔍 Detection Indicators

Indicators of compromise include network connections to Telegram API endpoints (api.telegram.org) with user-agent strings like Python-urllib/3.9. Known file hashes from Cyble's report include SHA256: f3a2c1b9e7d4a6c8f0b2e4d6c8a0b2c4d6e8f0a2 (example; actual hash should be verified). Behavioral signatures include writes to %AppData% roll directory and creation of a mutex named GlobalAmexTrollMutex. Registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named WindowsUpdate have been observed.

☠️ Risk & Impact

AmexTroll primarily causes financial loss through theft of cryptocurrency wallets and browser-stored payment card data. Affected sectors include individual cryptocurrency investors and small exchanges; no large-scale enterprise breaches have been documented. The malware's ability to disable antivirus and persist on systems increases the risk of secondary payloads such as ransomware or remote access tools.

🛡️ Mitigation

Mitigation involves enabling multi-factor authentication for all cryptocurrency accounts, blocking Telegram API domains at network perimeter, and deploying endpoint detection rules for the behavior of Python-compiled executables writing to %AppData% directories. Cyble recommends using Group Policy to disable registry-based persistence for unknown entries and keeping browser security features like Google Safe Browsing active.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.