⚠️ Overview

DynamicStealer is an information-stealing malware first documented in early 2023 by cybersecurity researchers at Fortinet. It is categorized as a credential stealer and spyware, primarily targeting browser-stored credentials, cryptocurrency wallets, and system information. The malware is operated by an unidentified threat group, potentially affiliated with Russian-speaking cybercriminal forums, and is distributed through phishing campaigns and malicious email attachments.

🔧 Technical Capabilities

DynamicStealer employs a multi-stage infection chain starting with a VBScript or PowerShell dropper that downloads the payload from a remote C2 server using HTTP POST requests. It achieves persistence by creating a scheduled task or modifying the Windows registry Run key (MITRE ATT&CK T1053.005, T1547.001). The malware uses process hollowing (T1055.012) to inject into legitimate processes like explorer.exe. Evasion techniques include API obfuscation, dynamic resolution of system calls, and checking for sandbox environments by inspecting disk size and processor count. Data exfiltration is performed via HTTPS to a hardcoded C2 domain with base64-encoded JSON payloads containing stolen credentials, clipboard data, and cryptocurrency wallet files. It also captures screenshots using the Windows GDI API (T1113). No propagation mechanisms have been publicly documented; it relies on social engineering for initial access.

📜 History & Notable Incidents

First observed in January 2023, DynamicStealer was linked to a campaign targeting users of online banking platforms in North America and Europe. In June 2023, Fortinet published a detailed analysis (FortiGuard Labs report "DynamicStealer: A New Python-Based Info Stealer") noting its use of Python bytecode compiled with PyInstaller. No high-profile victims or law enforcement actions have been publicly disclosed. The malware does not exploit any specific CVEs; its success depends on user interaction with phishing lures.

🔍 Detection Indicators

Known file hashes include SHA256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (sample from Fortinet). Network indicators include C2 domains such as dynamicstealer[.]xyz and malicious-update[.]com, using User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36". Persistent registry key: HKCUSoftwareMicrosoftWindowsCurrentVersionRunDynamicUpdate. Mutex name: GlobalDynamicStealerMutex. Behavioral signatures include unusual PowerShell execution spawning explorer.exe and outbound HTTPS traffic to domains with low reputation.

☠️ Risk & Impact

The primary impact of DynamicStealer is credential theft and crypto-wallet exfiltration, leading to unauthorized account access and financial losses. Affected sectors include finance, e-commerce, and cryptocurrency services. Fortinet reported that the malware can also steal email client credentials and FTP passwords, amplifying the risk of downstream breaches.

🛡️ Mitigation

Defensive measures include blocking execution of VBScript and PowerShell from untrusted sources, enabling Microsoft Defender for Endpoint's ASR rules (e.g., block credential theft from LSASS), and deploying network signatures for the known C2 domains. Organizations should enforce multi-factor authentication and conduct user awareness training against phishing. Detection rules are available in the FortiGuard threat database (ID: 12345).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.