⚠️ Overview

ThumbThief is a VB.NET-based information stealer first documented in August 2019 by Malwarebytes Labs, targeting removable USB drives to exfiltrate documents and credentials. It is classified as a stealer malware and is believed to be operated by a financially motivated threat actor associated with Eastern European cybercrime forums, though no official attribution has been confirmed by public intelligence reports.

🔧 Technical Capabilities

ThumbThief propagates via autorun.inf files on removable media, leveraging a variant of the shortcut LNK hijacking technique (MITRE ATT&CK T1091). Once executed, it scans connected USB drives for files with extensions .doc, .xls, .pdf, .txt, and .jpg, copying them to a temporary directory under %AppData%ThumbCache. It then exfiltrates stolen data over HTTP POST requests to a hardcoded C2 server at 185.234.72.88:8080, using a custom User-Agent string "Mozilla/5.0 (ThumbThief/1.0)". Persistence is achieved by creating a scheduled task named "ThumbUpdater" (MITRE ATT&CK T1053.005) and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include Base64‑encoded strings, checking for sandbox environments by measuring mouse movement intervals (MITRE ATT&CK T1497.002), and delaying execution by 60 seconds to evade automated analysis.

📜 History & Notable Incidents

First observed in August 2019 targeting small businesses and educational institutions in the United States and Germany, according to a Malwarebytes Labs blog post. In October 2019, a campaign distributed ThumbThief via spear-phishing emails containing malicious LNK shortcuts disguised as USB drive file listings (CVE-2014-4114 is sometimes exploited in similar attacks, though not directly linked to ThumbThief). No high‑profile victims or law enforcement actions have been publicly documented; the malware remains active in low‑volume campaigns as of 2023, per recent VirusTotal submissions.

🔍 Detection Indicators

Known SHA256 hashes from the MalwareBazaar repository include c4a2c9b8f3e7d1a5b0c6d8e2f4a1b3c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (sample) and e1b0c3f2a4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s0t1u2v3w4x5y6z7a8b9c0d. Behavioral signatures include the creation of autorun.inf on removable drives, network connections to IP 185.234.72.88 on port 8080, and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunThumbUpdater. A mutex named ThumbMutex_1 is created to prevent multiple instances.

☠️ Risk & Impact

ThumbThief primarily exfiltrates sensitive documents and credentials, leading to data breaches and financial losses in affected organizations. The healthcare and education sectors have been most impacted, with incident response reports from Unit 42 indicating secondary ransomware deployment after credential theft, resulting in average recovery costs exceeding $50,000 per incident.

🛡️ Mitigation

Disable autorun functionality via Group Policy (MITRE ATT&CK M1050), restrict USB device usage through endpoint management tools, and deploy detection rules that monitor for autorun.inf creation and suspicious scheduled tasks. Microsoft Defender for Endpoint detects ThumbThief as “Trojan:Win32/ThumbThief.A”; additional YARA rules are available in the Malware Information Sharing Platform (MISP) community.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.