Prynt Stealer Kötü Amaçlı Yazılım Dark Web'de Yalnızca Satıyor $100 her ay

Cybersecurity specialists from Cyble keşfetti a new information-stealing malware called Prynt Stealer. The malware has a wide range of capabilities and comes with additional keylogger and clipper modules.

Prynt Stealer is advertised as a solution to compromise a wide variety of browsers, instant messengers and gaming applications, and it is also capable of carrying out direct financial attacks.

Prynt Stealer is a subscription service and the authors charge $100/month, $200/quarter, or $700/year, and offer a lifetime license for $900.

Bu arada, if you are interested in the darknet criminal life, you might like our article: Darknet sites of the REvil group are working again: Ruslar siber suçluları doğaya saldı mı?? or you might be interested in this information: Kırmızı Hat Hırsızı malware is the main source of credentials in two major marketplaces.

Dahası, buyers can use the constructor to create their own, compact and hard-to-detect version of the malware that can be used in targeted attacks.

Prynt Hırsız Kötü Amaçlı Yazılım

Cyble analysts write that Prynt Stealer was created with an emphasis on stealth and uses binary obfuscation and string encryption using Rijndael. Ek olarak, all communications with the management servers are encrypted using AES256, and the AppData folder (and subfolders) needed to temporarily store stolen data is hidden.

Prynt Hırsız Kötü Amaçlı Yazılım

Once on the victim’s machine, Prynt Stealer scans all disks on the host and steals documents, database files, source code, and image files smaller than 5120 bytes (5 KB).

Daha sonra, the malware switches to browsers based on Chrome, Firefox and MS Edge, stealing autofill data, credentials, bank card information, search history and cookies. At this stage, the malware uses ScanData() to search browser data for keywords related to banks, cryptocurrencies, and porn sites, and steals what it finds if information is found.

After Prynt Stealer attacks messengers, dahil olmak üzere anlaşmazlık, Pidgin ve Telgraf, and steals Discord tokens if they are in the system. Game application authorization files, game save files and other valuable data from Ubisoft Uplay, Buhar ve Minecraft are also stolen.

In the end, the malware queries the registry to find the data of cryptocurrency wallets such as Zcash, Armory, Bytecoin, Jaxx, Ethereum, AtomicWallet, Guarda ve Coinomi, and also steals information from FileZilla, OpenVPN, NordVPN and ProtonVPN by copying the corresponding credentials to the one mentioned above. subfolder in AppData.

Before the actual theft, Prynt Stealer also performs general system profiling, including creating a list of running processes, taking a screenshot, and linking the collected information to the network credentials and Windows key that is used on the victim’s machine.Cyble experts say.

The data transfer itself is carried out using a Telegram bot, which uses an encrypted network connection to upload the dump to a remote server.

Yukarıda da belirtildiği gibi, in addition to these functions, the malware is equipped with keylogger modules (to intercept keystrokes) and a clipper (tracks and replaces cryptocurrency addresses in the clipboard).

Experts summarize that the new Prynt Stealer is a very dangerous malware that can steal user confidential data, lead to significant financial losses, account compromise and data leakage.

Helga Smith

Bilgisayar bilimlerine her zaman ilgi duymuşumdur., özellikle veri güvenliği ve tema, günümüzde denilen "veri bilimi", ilk gençlik yıllarımdan beri. Baş Editör olarak Virüs Temizleme ekibine gelmeden önce, Birkaç şirkette siber güvenlik uzmanı olarak çalıştım, Amazon'un yüklenicilerinden biri dahil. Başka bir deneyim: Arden ve Reading üniversitelerinde öğretmenlik var.

Cevap bırakın

Bu site spam azaltmak için Akismet kullanır. Yorumunuz verileri işlenirken öğrenin.

Başa dön tuşu