A recently uncovered malware variant, dubbed “QWERTY Info Stealer,” has surfaced, presenting a serious risk to Windows platforms due to its sophisticated anti-debugging mechanisms and data theft capabilities.
This malware is distributed through the domain mailservicess[.]com and poses a considerable danger to both individual users and enterprises. Our in-depth examination reveals its technical features, including its methods for avoiding debugging, data harvesting techniques, and interaction with Command and Control (C2) servers.
Discovery of QWERTY Info Stealer
QWERTY Info Stealer was first identified on a publicly accessible web server with the domain mailservicess[.]com, which is hosted on a Linux virtual private server located in Frankfurt, Germany. This server runs on Ubuntu Linux 20.04 and has minimal services exposed, with SSH being the only open service on port 6579.
The malware can be downloaded from the URL hxxps://mailservicess[.]com/res/data/i.exe and utilizes complex anti-debugging techniques to avoid detection.
Anti-Debugging Measures
As reported by Cyfirma, QWERTY Info Stealer implements several anti-debugging techniques to elude security analysis. Upon activation, it checks for debuggers using Windows API functions like IsProcessorFeaturePresent() and IsDebuggerPresent().
It also leverages the relatively obscure __CheckForDebuggerJustMyCode function, which is not commonly documented or used in typical applications. These measures are designed to halt the malware’s execution if a debugging environment is detected, complicating the efforts of analysts.
Data Collection and Exfiltration
After bypassing the anti-debugging checks, QWERTY Info Stealer starts its data collection phase. It creates directories on the compromised system to store the captured data and logs, such as C:\Users\AppData\Roaming\TestLog\ and C:\Users\user\AppData\Roaming\Intel.
The malware retrieves system information using API calls including GetComputerNameA(), GetAdaptersInfo(), GetVersionExA(), and GetUserNameA(). Additionally, it targets Internet Explorer data by accessing sensitive browser files, history, and cookies. It replicates itself under the name “Systems.exe” in the directory C:\Users\AppData\Roaming\Mozilla\ and establishes connections to its C2 servers to fetch further payloads for execution.
Interaction with Command and Control Servers
QWERTY Info Stealer communicates with its C2 servers to download additional executables like in.exe and up.exe, which are saved as “index.exe” and “upload.exe” in the C:\Users\AppData\Roaming\intel directory.
These files are executed to index all the system’s files and upload them to the C2 server via HTTP POST requests. The malware’s use of the keyword ‘qwerty’ in its HTTP requests during the exfiltration process provides a distinctive signature.
The QWERTY Info Stealer represents a highly advanced threat to Windows systems. Its intricate anti-debugging techniques and extensive data exfiltration capabilities make it a formidable challenge in the cybersecurity domain.
The malware’s ability to collect detailed system telemetry and browser data, along with its file indexing operations, underscores the necessity for ongoing vigilance and advanced detection measures to counteract such threats.
Cybersecurity professionals must stay abreast of the latest threats and implement robust security protocols to shield systems and data from malicious activities.
The emergence of QWERTY Info Stealer highlights the evolving tactics of cybercriminals and the need for constant adaptation in the battle against malware. By understanding the technical details of threats like QWERTY Info Stealer, organizations can enhance their preparedness and response strategies, protecting their critical assets and preserving the integrity of their information systems.
