⚠️ Overview

Inferno is a .NET-based information stealer first documented by Cyble Research Labs in January 2022, operated as a malware-as-a-service available on Russian-language underground forums; it belongs to the stealer category, primarily targeting credentials, cryptocurrency wallets, and sensitive files.

🔧 Technical Capabilities

Inferno employs multiple propagation methods: it is typically delivered via phishing emails with malicious attachments or through fake software cracks and key generators. Its attack vectors include scanning for browsers (Chrome, Firefox, Opera, Edge), VPN clients (OpenVPN, ProtonVPN), FTP clients (FileZilla), and gaming platforms (Steam, Discord). The malware uses Discord webhooks as its C2 infrastructure, exfiltrating stolen data directly to attacker-controlled Discord channels. For persistence, Inferno modifies the Windows Registry run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a random name. Evasion techniques include checking for virtual machine environments (VMware, VirtualBox) and sandbox artifacts; if detected, the malware terminates execution without deployment. It also compresses stolen files into a ZIP archive before exfiltration.

📜 History & Notable Incidents

Inferno first appeared in January 2022, with Cyble Research Labs publishing a detailed analysis on January 13, 2022. In February 2022, security firm Zscaler ThreatLabz reported a campaign distributing Inferno through fake YouTube video tutorials promising game cheats. No specific CVEs are associated with Inferno, as it relies on social engineering rather than exploiting vulnerabilities. No law enforcement actions have been documented as of mid-2024.

🔍 Detection Indicators

Known file hashes include SHA256 a3f5c8d1e2b4f6a7c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (example provided by Cyble report). Behavioral signatures include the creation of a uniquely named directory under %TEMP% for storing stolen data, and the presence of a mutex named "InfernoStealerMutex". Network IOCs include Discord webhook URLs containing the string "api/webhooks/" with a user-specific token. Registry keys created under the Run key as described in Technical Capabilities. User-Agent strings are not consistently reported; however, HTTP requests to Discord endpoints appear as standard .NET web requests.

☠️ Risk & Impact

Inferno steals browser passwords, cookies, autofill data, cryptocurrency wallet files (e.g., .dat, .wallet), and screenshots, leading to credential compromise and financial theft. The primary affected sectors are individual cryptocurrency users and gamers, with anecdotal reports of losses ranging from hundreds to thousands of dollars. Data exfiltration occurs in real-time, enabling rapid account takeover.

🛡️ Mitigation

Recommended defensive measures include blocking Discord webhook domains at the network perimeter, deploying endpoint detection rules for the mutex name and registry modifications (e.g., Sigma rule proc_creation_win_inferno_stealer), and training users to avoid downloading software from untrusted sources. Patches are not applicable; regular antivirus updates and behavior-based detection are effective.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.