Log in Request a demo

Ransomware

Invicta Stealer Technical Analysis

Invicta Stealer is a malicious software designed to steal sensitive user information, with a focus on targeting Discord, wallets, and web browsers.

Brandefense logo Updated 2 Min Read
stealer malware named invicta explained by brandefense research team

Invicta Stealer is malware built to steal sensitive user information, mainly from Discord, wallets and web browsers. Its builder was released on GitHub in April, so attackers can customize it easily. It uses syscalls, anti-analysis techniques and API hashing to avoid detection, and it hides its command and control address with AES encryption and Base64 encoding.

This blog post comes from the “Invicta Stealer Technical Analysis” by the Brandefense Research Team. For more details about the analysis, download the report.

What does this Invicta Stealer analysis cover?

This report includes a general overview and technical analysis of Invicta Stealer. At the end of the report, the obtained Indicators of Compromise (IoCs) and the written YARA rule have been shared.

What is in scope for the Invicta Stealer analysis?

In the ”Scope” section, hashes of the analyzed ”Invicta Malware” sample are given.

Filenameac3e7f3c9b98de937715b84bea470a00debb3eddbe91f13504519ae2f2dc610e.exe
MD58a9e7741ad1976685d7b64706760f022
SHA12c10875b3a75cef2e785cd23f6ecbb842c2d08c8
SHA256ac3e7f3c9b98de937715b84bea470a00debb3eddbe91f13504519ae2f2dc610e

What Is Invicta Stealer?

Invicta Stealer is a malicious software designed to steal sensitive user information, with a focus on targeting Discord, wallets, and web browsers. It has gained attention due to its utilization of various techniques to evade detection and propagate its malicious activities.

The malware first emerged in April with the release of its builder on GitHub, allowing threat actors to easily customize and distribute instances of the malware. Invicta Stealer leverages syscalls and anti-analysis techniques to interact with the operating system at a low level, making it challenging for security solutions to detect and analyze its behavior.

Once deployed, Invicta Stealer exfiltrates a range of user data, including credentials, financial information, and browser-related data. It employs API hashing to obfuscate the names of Windows API functions it utilizes, further complicating its detection and analysis.

The builder, written in .NET, enables customization of the malware’s behavior by replacing the encrypted Command and Control (C2) URL address. Additionally, it utilizes AES encryption and Base64 encoding to encrypt and encode the C2 address within the patched binary.

Our Threat Research Team has prepared a Python script for the Invicta Stealer Command and Control Address dump.

INVICTA STEALER C2 EXTRACTOR

Download YARA Rules and IoCs from GitHub.

Frequently Asked Questions.

What is Invicta Stealer?

It is malware designed to steal sensitive user information, with a focus on Discord, wallets and web browsers. It takes credentials, financial information and browser-related data. MITRE ATT&CK describes stealing credentials from web browsers as technique T1555.003.

How does Invicta Stealer avoid detection?

The post says it uses syscalls, anti-analysis techniques and API hashing. MITRE ATT&CK notes that hashes of function names are commonly stored in malware instead of literal strings, which hides which Windows APIs are called. It also describes using syscalls directly to get around defensive sensors (T1106).

How is the C2 address of Invicta Stealer hidden?

The .NET builder replaces the encrypted C2 URL and uses AES encryption and Base64 encoding to store the address inside the patched binary.

Where can I find Invicta Stealer IoCs and YARA rules?

The post links to the Brandefense GitHub page for the YARA rule and IoCs, and to a Python C2 extractor script.

Sources

  1. 1 MITRE ATT&CK: Dynamic API Resolution (T1027.007)
  2. 2 MITRE ATT&CK: Credentials from Web Browsers (T1555.003)
  3. 3 MITRE ATT&CK: Native API (T1106)
Share

In This Article

TermsCommand and control (C2) TermsIndicator of compromise (IoC) TermsYARA and Sigma rules TermsMalware TermsThreat actor

Where To Next.

All Ransomware Articles
In plain words · Glossary term Command and control (C2)

Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them.

Open → Keep reading · Article Cactus Ransomware Technical Analysis

The Cactus ransomware, initially observed in 2023, is a sophisticated malware variant that poses a significant threat to computer systems and their users.

Open → Keep reading · Article Gotham Stealer Technical Analysis

Gotham Stealer, a malware first seen in September 2023, targets browser data, crypto wallets and gaming accounts such as Discord, Steam and Roblox.

Open →

Knowledge HubRansomware groups