⚠️ Overview

GetMyPass is a password-stealing trojan first documented in 2013 by security researchers at F-Secure, categorized as an information stealer that specifically targets stored credentials from web browsers, FTP clients, and email applications such as Outlook and Windows Live Mail. The malware is attributed to an unknown threat actor and is typically distributed via malicious email attachments or drive-by downloads, often bundled with other malware strains like Zbot or Fareit.

🔧 Technical Capabilities

GetMyPass employs credential theft by injecting into browser processes (IE, Chrome, Firefox) and parsing saved password databases (e.g., Firefox’s signons.sqlite) using native Windows APIs like CryptUnprotectData. It exfiltrates stolen data over HTTP POST requests to a command-and-control (C2) server, using an encrypted custom protocol that encodes credentials in base64 and adds a simple XOR obfuscation layer. The malware achieves persistence by writing itself to the Windows registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a random name. Evasion techniques include checking for sandbox environments by detecting debugger processes (e.g., ollydbg.exe, windbg.exe) and terminating itself if found. According to F-Secure’s analysis (Report ID: FSC-2013-08), GetMyPass also targets credentials from FileZilla, WinSCP, and Total Commander FTP clients by reading configuration files.

📜 History & Notable Incidents

First observed in early 2013, GetMyPass was widely distributed during a coordinated campaign in May 2013 that used phishing emails masquerading as shipping notifications from UPS and FedEx, infecting over 10,000 victims globally. No high-profile corporate victims or CVEs have been directly linked to GetMyPass, though it was frequently detected as a secondary payload in larger malware campaigns (e.g., alongside Gozi and Ursnif). Law enforcement actions have not specifically targeted GetMyPass operators, but the malware’s source code was publicly leaked in 2015 on underground forums, leading to a surge of variants.

🔍 Detection Indicators

Known SHA256 hashes include a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c (F-Secure sample, 2013) and 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b (2014 variant). Behavioral signatures include creating registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRunwinsystem and network IOCs such as User-Agent string “Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)” combined with POST requests to IP addresses on port 8080. Researchers also note a mutex name “GetMyPassMutex” used to prevent multiple instances.

☠️ Risk & Impact

The primary risk is wholesale credential theft from personal and corporate accounts, enabling lateral movement and data exfiltration; affected sectors include small-to-medium businesses and individuals in finance and e-commerce. Although not ransomware, the stolen credentials can be used for identity theft, account takeover, and further malware propagation. Financial losses are indirect but significant, with compromised credentials often sold on dark web markets for $2–10 per set (based on 2014–2015 forums).

🛡️ Mitigation

Defenders should enforce multi-factor authentication (MFA) on all critical accounts, block outbound connections to known C2 IPs via firewall rules, and deploy endpoint detection rules (e.g., YARA signature: “GetMyPass” with XOR-encoded strings). Regularly updating browsers and disabling saved password features in enterprise environments reduces attack surface. No official patch exists; mitigation relies on antivirus signatures (e.g., F-Secure’s Trojan-Downloader:W32/GetMyPass.A) and user awareness training against phishing.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.