A Comprehensive Analysis of Angry Stealer: Rage Stealer in a New Disguise

Description

CYFIRMA's research team recently identified a sophisticated dropper binary designed to deploy an information stealer, dubbed 'Angry Stealer,' actively advertised on Telegram and other online platforms. The stealer targets sensitive data from browsers, cryptocurrency wallets, VPN credentials, and system details, exfiltrating it via Telegram. Analysis revealed 'Angry Stealer' is based on 'Rage Stealer,' sharing identical code and functionality. The dropper executes two payloads: the primary 'Stepasha.exe' for data theft and the secondary 'MotherRussia.exe,' potentially a builder tool for creating malicious executables.