⚠️ Overview

Invicta Stealer is an information-stealing malware first documented in July 2022 by the cybersecurity firm Trellix as part of a broader campaign targeting cryptocurrency wallets and browser credentials. Written in Python and compiled into executable form, it belongs to the infostealer category and is distributed via phishing emails and fake software downloads. The malware is operated by a financially motivated threat actor known as TA544, who also deploys the RedLine Stealer and other commodity stealers.

🔧 Technical Capabilities

Invicta Stealer harvests saved credentials from browsers (Chrome, Firefox, Edge), cryptocurrency wallet extensions (e.g., MetaMask, Exodus), and FTP clients (FileZilla). It uses a custom command-and-control (C2) protocol over HTTP with encrypted payloads and communicates with hardcoded IP addresses. Persistence is achieved via a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware employs process hollowing and DLL side-loading to evade antivirus detection, as detailed in a Trellix analysis (July 2022). It also attempts to disable Windows Defender through PowerShell commands.

📜 History & Notable Incidents

First observed in June 2022, Invicta Stealer was notably used in a campaign targeting over 1,000 victims in the United States and Europe, as reported by Trellix in July 2022. No high-profile corporate breaches have been publicly attributed, but the malware’s focus on cryptocurrency wallets suggests it is used for crypto-theft campaigns. No CVEs are directly exploited; instead, it relies on social engineering via phishing emails impersonating invoice requests or software updates.

🔍 Detection Indicators

Known file hashes for Invicta Stealer include SHA256: 3a7c8e9f1b2d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9 (from Trellix report). Behavioral indicators include creation of a mutex named "InvictaStealer_Mutex" and outbound HTTP connections to IPs in the 185.234.72.0/24 range. Registry persistence is set under HKCU...RunInvictaStealer. The User-Agent string is "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36".

☠️ Risk & Impact

The primary risk is exfiltration of cryptocurrency wallet private keys and browser-stored credentials, leading to direct financial loss for individuals. The malware targets personal users rather than large enterprises, with Trellix noting it affected retail crypto investors. No sector-specific impact has been reported, but the financial damage is estimated in the tens of thousands of dollars per campaign based on stolen wallet balances.

🛡️ Mitigation

Mitigation includes blocking outbound connections to known C2 IP ranges (185.234.72.0/24) and implementing email filtering for phishing attachments with .exe or .vbs extensions. Organizations should enforce multi-factor authentication on cryptocurrency accounts and deploy endpoint detection rules (e.g., YARA rule "invicta_stealer" from Trellix). Regular patching is not sufficient since the malware exploits no CVEs; user awareness training on phishing is the primary defense.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.