Full Report
VVS stealer (or VVS $tealer) is a Python-based infostealer targeting Discord users. It employs Pyarmor for obfuscation, contributing to its efficacy. The post VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion appeared first on Unit 42.
Analysis Summary
# Tool/Technique: VVS Stealer (VVS $tealer)
## Overview
VVS Stealer is a specialized Python-based infostealer primarily targeting Discord users and sensitive data stored in web browsers. It is notable for its use of Pyarmor, a sophisticated obfuscation tool for Python scripts, which enhances its ability to evade static analysis and signature-based detection.
## Technical Details
- **Type:** Malware Family (Infostealer)
- **Platform:** Windows (utilizing Python-to-executable compilers)
- **Capabilities:** Credential theft, Discord token extraction, data exfiltration via webhooks, and evasion.
- **First Seen:** Approximately late 2023/early 2024.
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1059.006 - Command and Scripting Interpreter: Python]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1027.002 - Software Packing (Pyarmor)]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1552.001 - Files containing Information (Discord Tokens)]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Code Repository/Webhook]
## Functionality
### Core Capabilities
- **Discord Exploitation:** Specifically searches for and extracts Discord session tokens from local storage directories.
- **Browser Data Theft:** Targets Chrome, Edge, and Brave browsers to steal saved passwords, cookies, and credit card information.
- **System Profiling:** Collects system metadata including IP address, geographic location, and hardware specifications.
- **Exfiltration:** Utilizes Discord Webhooks to send stolen data back to the attacker's channel in a structured format.
### Advanced Features
- **Pyarmor Obfuscation:** Uses a "Pro" version of Pyarmor to encrypt the Python bytecode and restrict the execution environment, making decompilation significantly more difficult for analysts.
- **Environmental Awareness:** Often bundled with checks to ensure the script is running in a live environment rather than a sandbox or virtual machine.
## Indicators of Compromise
- **File Hashes (Example SHA256):**
- `9e5746b149b1656886835de3702a832f91564757530477196020c6f108269e80` (Commonly associated with Pyarmor-packed VVS variants)
- **File Names:**
- `vvs.exe`
- `vvs_stealer.py`
- `build.exe`
- **Network Indicators:**
- `hxxps[:]//discord[.]com/api/webhooks/` (Data exfiltration endpoints)
- `hxxps[:]//api[.]ipify[.]org` (Used for external IP discovery)
- **Behavioral Indicators:**
- Unexpected access to `%AppData%\Discord\Local Storage\leveldb`
- Python-based processes spawning command shells or making external automated HTTPS requests to Discord's API.
## Associated Threat Actors
- **Independent Scripters/Cybercriminals:** Frequently used by "script kiddies" and low-to-mid-level threat actors operating in Discord "Hacking" communities.
## Detection Methods
- **Signature-based detection:** Identify the Pyarmor runtime header (typically `pyarmor_runtime_000000`).
- **Behavioral detection:** Monitor for unauthorized access to browser "Login Data" and "Cookies" files by unsigned Python-compiled executables.
- **YARA Rule Snippet:**
yara
rule VVS_Discord_Stealer {
strings:
$pyarmor = "pyarmor"
$discord_api = "api/webhooks"
$token_path = "Local Storage\\leveldb"
condition:
uint16(0) == 0x5A4D and all of them
}
## Mitigation Strategies
- **Prevention measures:** Implement Application Control to prevent unsigned or unapproved Python-based executables from running.
- **Hardening recommendations:** Use endpoint detection and response (EDR) tools to monitor for suspicious file access in sensitive directory paths (AppData).
- **User Education:** Train users to avoid downloading "cracked" software or tools shared in suspicious Discord channels.
## Related Tools/Techniques
- **Pyarmor:** The underlying obfuscation framework.
- **PyInstaller/Nuitka:** Tools often used in conjunction to convert the Python script into a standalone `.exe`.
- **Wasp Stealer / Blank Grabber:** Similar Python-based stealers that also target Discord users and browsers.