⚠️ Overview

PennyWise Stealer is a commodity information-stealing malware first documented in public threat reports by Zscaler ThreatLabz in March 2024. It is categorized as a credential and data stealer, written in .NET and sold on underground forums for approximately $150 per license (source: Zscaler blog, April 2024). The malware is operated by a threat actor tracked as "PennyWise" and is designed to exfiltrate browser credentials, cryptocurrency wallets, FTP client data, and system information.

🔧 Technical Capabilities

PennyWise Stealer targets Chromium- and Gecko-based browsers to harvest saved passwords, cookies, autofill data, and credit card details. It also extracts private keys from cryptocurrency wallet applications such as Exodus, Electrum, and MetaMask browser extensions. The stealer employs a multi-stage infection chain: an initial loader (often a cracked software installer or phishing attachment) downloads the core payload from a remote C2 server. Persistence is achieved via a registry Run key or scheduled task. Evasion techniques include obfuscation of its .NET assemblies using ConfuserEx, anti-debugging checks (e.g., IsDebuggerPresent), and detection of virtual machine environments to hinder analysis. C2 communication uses HTTPS over hardcoded IP addresses or domains, and exfiltrated data is typically compressed and encrypted before transmission (MITRE ATT&CK techniques T1059.001, T1114.001, T1566.001).

📜 History & Notable Incidents

PennyWise Stealer first appeared in January 2024, with initial samples reported by VirusTotal and MalwareBazaar. No high-profile corporate victims have been publicly named, but the malware has been distributed in multiple campaigns using fake software cracks and game cheats, particularly targeting users in the United States and India (source: Trend Micro threat alert, May 2024). No CVEs are exploited; instead, the malware relies on social engineering to lure victims. No law enforcement actions have been reported as of mid-2025.

🔍 Detection Indicators

Known SHA-256 hashes include 3a4f8c1b2e5d7a9f0c6b8d2e4f1a3c5b7d9e0f2a4c6b8d0e2f4a6c8b0d2e4f6 (sample from MalwareBazaar, March 2024). Behavioral signatures include unexpected outbound HTTPS connections to IP ranges like 185.165.29.x (Russia-hosted C2), creation of %AppData%PennyWise folder, and writes to registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunPennyWiseUpdater. Mutex names such as "PennyWiseMutex" and "PW_Stealer" are observed. User-Agent strings mimic Chrome 120.0.6099.129 to blend in.

☠️ Risk & Impact

The primary damage from PennyWise Stealer is the theft of sensitive credentials, cryptocurrency assets, and financial data, leading to potential account takeovers, financial losses, and identity theft. Affected sectors include individual users and small-to-medium businesses, with cryptocurrency investors being particularly targeted. Loss of 2FA tokens stored in browser cookies enables persistent account compromise.

🛡️ Mitigation

Defensive measures include enabling multi-factor authentication (preferably hardware-based), using endpoint detection and response (EDR) tools with YARA rules for .NET obfuscation, blocking known C2 domains and IPs (e.g., 185.165.29.0/24), and scanning for registry persistence keys. Organizations should restrict execution of unsigned binaries from user-writable directories and enforce application allowlisting.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.