META ! The Infostealer Malware

Researchers have identified a new campaign that looks dispensing the novel META malware in scattered manner., META is an infostealer malware, which can harvest passwords and other login data from browsers, as well as from cryptocurrency wallets.

The distribution campaign is nothing out of the ordinary, with threat actors opting for emails and macro-heavy Excel files. The emails are usually a notification about fund transfers, with details found on the link attached to the email.

Advertisements

The link leads to DocuSign, a well-known digital signature service provider, where users are invited to download the Excel file and urged to enable content which enables malicious macros that tend to fool the victims

The macro will then download multiple payloads, hosted on GitHub. The final payload, once assembled, will be visible on the compromised endpoint under qwveqwveqw.exe. It will also have a registry key, for persistence.

META is found to modify Windows Defender via PowerShell, to exclude .exe files from being scanned by antivirus software.

META is one of a couple of new infostealer which are trying to fill the void after Racoon Stealer disaqppear3ed. It’s being sold online for a monthly subscription of $125. Those interested in unlimited, lifetime use, will have to shell out $1,000. META is built upon Redline Stealer, another hugely popular infostealer.

Redline Stealer is often used to steal passwords stored in people’s browsers and is usually sold online for roughly $150 – $200. As email is the most popular distribution method, security experts are warning users to be extra careful when accepting attachments from emails or clicking on links.