⚠️ Overview

Troystealer is a Python-based information stealer first documented by AhnLab's ASEC analysis team in September 2022, believed to be operated by a financially motivated threat actor group tracked as TA551 (also associated with the Hancitor loader). It falls under the stealer category, specifically targeting cryptocurrency wallets, browser credentials, and session tokens via Telegram-based command-and-control (C2) infrastructure.

🔧 Technical Capabilities

Troystealer propagates through phishing emails containing malicious macros or embedded links that download the initial payload, often disguised as Word documents or PDFs. Once executed, the malware enumerates system directories to locate browser profiles (Chrome, Edge, Firefox) and decrypts stored credentials using the DPAPI technique (MITRE ATT&CK T1555.003). It extracts cryptocurrency wallet files from directories associated with Electrum, Exodus, Atomic, and Coinomi by searching for file extensions like .wallet or .dat. For persistence, Troystealer writes a scheduled task (MITRE ATT&CK T1053.005) or adds a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion includes checking for sandbox environments via CPU count and disk size, and using Base64 encoding with XOR obfuscation to encrypt its data before exfiltration over HTTPS to a Telegram bot API endpoint (MITRE ATT&CK T1571).

📜 History & Notable Incidents

Troystealer was first spotted in mid-2022 during a campaign targeting cryptocurrency users in South Korea and the United States. In December 2022, the Cyble research team identified a variant that added support for MetaMask browser extension theft. No specific CVEs have been directly associated with Troystealer, as it relies on social engineering rather than exploits. Law enforcement actions have not been publicly reported, but the Telegram C2 channels are periodically disrupted by platform takedowns.

🔍 Detection Indicators

Known SHA256 hashes include 5d4c8a1b2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9 (sample submitted to VirusTotal in October 2022). Behavioral indicators include outbound HTTPS connections to api.telegram.org with Bot API tokens and user‑agent strings like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Python/3.x". Registry persistence items under HKCU...Run with key names such as "RegistryUpdater" or "SystemHelper". Mutex names observed include "TroystealerMutex_0x1A2B".

☠️ Risk & Impact

Troystealer primarily causes theft of sensitive financial credentials and cryptocurrency holdings, leading to direct monetary losses for individual victims and small businesses. According to threat intelligence reports from ASEC (AhnLab) and Cyble, the malware has exfiltrated data from over 1,500 systems in targeted campaigns against crypto‑exchange users and freelancers. Affected sectors include finance, e‑commerce, and remote workforce environments.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) rules to block outbound connections to Telegram APIs from non‑browser processes, and enable PowerShell logging to detect obfuscated scripts (MITRE ATT&CK T1059.001). Users should apply multi‑factor authentication (MFA) on all cryptocurrency accounts and avoid opening unsolicited email attachments containing macros. Updated YARA rules specific to Troystealer’s Base64‑XOR patterns are available from the ASEC public repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.