In-Depth Technical Analysis of SEIDR Stealer

INTRODUCTION

On December 28, a new info-stealer called SEIDR Information Stealer appeared on
an underground Telegram channel. SEIDR is written in C++ and is priced at $70 for a
basic plan and $200 for a Pro plan. Its capabilities include targeting both Chromium
and Gecko-based browsers. The stealer can detect virtual machines and deploy a two-staged
module running a crypto clipper and a keylogger.

WHAT IS AN INFOSTEALER?

An info stealer malware is a type of malicious software (malware) that is designed to
infiltrate a victim’s computer system, gather sensitive or valuable information, and
send it back to the attacker. The stolen information can include passwords, credit card
numbers, personal identification information, and other data that can be used for
identity theft or other criminal purposes.

KEY FEATURES

Seidr stealer is a new information stealer written in C++ discovered on December 28, and it is capable of gathering information such as logins, passwords, autofill data, cookies, and credit card details from Chrome, Brave, 7 Star, Yandex, Edge, Ucoz Media, Amigo, Torch. The malware also targets cryptocurrency wallets.

The malware is able to deploy a two-staged module that concurrently executes a crypto clipper and a keylogger.

Seidr stealer sends the gathered information via telegram.

Seidr Stealer implemented various techniques to detect if it runs on virtual machines and sandboxes.

RECENT UPDATES

The malware developer announced that he has recently updated the malware with
new features included, (Stealing telegram desktop information, adding 5 more methods
to detect VM and AV sandbox, implemented a method to retrieve Google oAuth
cookies after a password reset)

SEIDR PANEL

For the past few days, the malware developer has been announced the availability of
the new panel on their Telegram channel

TECHNICAL ANALYSIS

Seidr is hosted in the cloud, and when you purchase a package, a custom build is
created based on your preferences and hosted for you, with a provided link. You have
the option to use your own loader or request the FUD Seidr loader to distribute your
stealer. Seidr is available in either a static build (full exe with no linked library (dll)) or
a dynamic build with some dependent DLLs. This flexibility ensures compatibility with
any loader.

The distribution method is chosen to maintain Seidr’s Fully Undetectable (FUD) status.
Every build undergoes rehashing, and a fresh certificate is applied, effectively bypassing
heuristic detection, and frustrating any attempts at static analysis.

Seidr Stealer employs various anti-analysis techniques to avoid detection by security
solutions. In this report, we will discuss the following anti-analysis techniques:

ANTI-ANALYSIS TECHNIQUES

Firstly, Seidr Stealer discovers the name of its ‘parent’ process and then compares this
parent name with the uppercase image name of ‘WINDBG.EXE.’ If the comparison
matches, the function returns, indicating a debugging tool is attached.

PROGRAMS BLACKLIST

Additionally, suppose the stealer detects a process from the provided list running. In that case, it takes the name of that process as input, searches for the corresponding process in the system, and terminates it if found.

Seidr stealer also has a blacklist of IPs, MAC addresses, computer names, usernames, UIDs, and process names of analysis tools. This approach uses a blacklist that attackers use to evade security solutions to detect virtual machines and prevent the execution. If it finds a one element of these blacklists

Then, the stealer collects some information about the infected system, like

●     username of the infected system

●     computer name of the infected system

●     the uid of the infected system

●     get information about a location like (IP, city, and country)

The Seidr stealer specifically aims to harvest data from specific cryptocurrency wallets and puts the stolen info in the folder.

• “c:/seidr/output/wallets.”

List of the crypto wallet extensions to be enumerated and collected:

Desktop Wallets:

List of the desktop wallets enumerated and collected:

• Monero
• MultiDoge
• Electrum
• Electrum Cash

Seidr Stealer enumerates and collects information from various browsers, including:

• Chrome
• Firefox
• Brave
• 7 Star
• Edge
• Yandex
• Ucoz Media
• Amigo
• Torch
• Chrome Canary
• Cent
• Sputnik
• Iridium
• Orbitum
• Epic Privacy
• Kometa

The malware harvests and steals data from (Browser Logins, Autofill, Saved credit cards, and Cookies).

The malware combines a keylogger with regular expressions to harvest and steal clipboard data. The malware’s modular has specific regular expressions to identify and target cryptocurrency wallet addresses.

Then. Seidr Stealer can log the keystrokes and send them to a telegram chatbot.

The malware also enumerates and collects a set of system information, storing the data in a text file at C:/seidr/output/system info.txt.

Here’s a list of the information being collected and written to the system info.txt file:

User Logon Information:

• System Name
• Username
• OS Version
• Screen Resolution
• Hardware ID (HWID)

Installed Apps:

The stealer logs information about installed applications on the system. Iterating through installed apps to gather details about each application.

The malware employs a persistence mechanism to ensure its execution during system startup. Following the creation of a new path by appending ‘\appdata\local\seidr\seidr.exe’ to the source path, the code proceeds to create a corresponding directory, and then the malware attempts to create or open a registry key under

• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

This key, commonly associated with system startup configurations, allows programs to be executed automatically upon user login.

Exfiltration

The malware compresses the log folder into a ZIP file and then sends it via Telegram.

then, the malware uses curl to send the log file to this telegram chatbot

We observed a new version of this info stealer by comparing those two log files:

Yara Rule

rule seidr_stealer{
	meta:
		author = "mohamed adel - Dark Atlas Squad"
		description = "Yara rule to detect seidr stealer"
		hash = "90bd78de6f692255a95c7cf07d7547dd783c3580cda0d95a515f25b564f8fe43"
		date = "1/25/2024"
	strings:
		$a1 = "clipped litecoin" ascii
		$a2 = "Screen Resolution" ascii
		$a3 = "/appdata/local/Kometa/user data/" ascii
		$a4 = "https://ipinfo.io/json" ascii
		$op1 = {8B C2 C1 E8 ?? 33 C2 69 D0 ?? ?? ?? ?? 03 D1 89 54 8D ?? 48 FF C1 48 81 F9 ?? ?? ?? ?? 72 ?? C7 45 ?? ?? ?? ?? ?? 44 8B 6D ?? 41 FF CD 0F 57 C0 0F 11 44 24 ?? 4C 89 74 24 ?? 41 BF ?? ?? ?? ?? 4C 89 7C 24 ?? C6 44 24 ?? ?? 45 8D 67 ?? 0F B6 5C 24}
	condition:
		uint16(0) == 0x5A4D and filesize < 3MB and $op1 and 3 of ($a*)
}

MITRE ATT&CK

INDICATORS OF COMPROMISE (IOCS)