⚠️ Overview

doenerium is an open-source information stealer first identified in early 2022, written in C# and publicly available on GitHub, developed by an unknown threat actor using the pseudonym “doenerium.” It belongs to the infostealer category, specifically targeting browser credentials, cryptocurrency wallets, and session cookies for exfiltration via Discord webhooks or Telegram bots.

🔧 Technical Capabilities

doenerium collects saved passwords, cookies, autofill data, and credit card details from Chromium- and Firefox-based browsers by parsing local SQLite databases and decrypting encrypted fields using built-in Windows DPAPI or Chromium’s AES key extraction. It targets over 40 cryptocurrency wallets including MetaMask, Exodus, Electrum, and Binance Chain, scraping wallet files and recovery phrases from %AppData% and %LocalAppData%. The malware achieves persistence through a scheduled task or registry Run key modification under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, it checks for sandbox environments and debuggers (e.g., SbieCtrl, wireshark, process names), terminates analysis tools, and uses anti-VM techniques such as checking disk size, RAM, and MAC addresses of virtual adapters. C2 communication is handled via HTTP POST requests to Discord webhook URLs or Telegram bot APIs, encoding exfiltrated data as JSON in the request body.

📜 History & Notable Incidents

First appearing on GitHub in April 2022, doenerium quickly gained traction among low-sophistication threat actors through underground forums and YouTube tutorials. A major campaign in mid-2022 involved fake “Valorant” and “Minecraft” cheats repackaged with doenerium, leading to widespread credential theft. No specific CVEs are attributed to doenerium itself, as it relies on user execution; however, it has been used in conjunction with older Microsoft Office exploit kits. Law enforcement actions have not directly targeted the malware, but takedowns of public GitHub repositories have occurred intermittently.

🔍 Detection Indicators

Common file hashes for doenerium include SHA256: 6e8b4f5a2c1d3e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f (sample from Zscaler). Behavioral indicators include outbound connections to Discord (discord.com/api/webhooks/) or Telegram (api.telegram.org/bot), creation of scheduled tasks named “WindowsUpdate” or “MicrosoftEdgeUpdate,” and dropped files in %Temp% with names like “doenerium.exe” or “loader.dll.” Registry persistence keys under Run with values pointing to those files are also telltale signs.

☠️ Risk & Impact

doenerium primarily causes data exfiltration of login credentials, cryptocurrency assets, and session tokens, leading to account takeovers, financial theft, and identity fraud. The malware targets individual users rather than organizations, but compromised credentials can be leveraged for lateral movement in enterprise environments. Sectors most affected include gaming (for in-game currency), cryptocurrency investors, and general consumers using browser-based password managers.

🛡️ Mitigation

Mitigation includes enforcing application whitelisting to block untrusted executables, enabling Microsoft Defender for Endpoint with cloud-delivered protection, and deploying custom YARA rules detecting doenerium’s hardcoded webhook URLs or anti-analysis strings. Users should avoid downloading cracked software or cheats, and organizations should implement DNS filtering to block connections to Discord webhook domains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.