Follow on X RSS Feed
Malware

The Styx Stealer Threat: What You Need to Know

Cybersec Sentinel

• 2 min read
The Styx Stealer Threat: What You Need to Know

Overview

Styx Stealer is a sophisticated information-stealing malware targeting Windows systems, with a primary focus on cryptocurrency theft and data exfiltration. It is an advanced variant of the older Phemedrone Stealer and has been actively distributed since April 2024. This malware exploits vulnerabilities in outdated Windows Defender versions, making it particularly dangerous for users with unpatched systems.

How It Works

Styx Stealer is engineered to steal a wide array of sensitive information:

  • Browser Data: It targets Chromium- and Gecko-based browsers to extract saved passwords, cookies, and auto-fill data.
  • Cryptocurrency Theft: The malware includes a "crypto-clipper" feature that monitors the clipboard during transactions, replacing wallet addresses with those controlled by the attacker.
  • System Information: Styx Stealer gathers detailed system information, including hardware details, external IP addresses, and environmental screenshots.
  • Instant Messaging Sessions: It can capture session data from popular messaging applications like Telegram and Discord, further extending its reach into personal communications.

The malware achieves persistence by adding itself to the system's startup processes, ensuring it remains active even after a reboot. Additionally, it incorporates anti-analysis techniques to evade detection by security solutions and sandboxes.

Detection

Styx Stealer is identified by various security products under different names, making it recognizable across a wide range of antivirus software:

  • Avast: Win32[Trj]
  • Combo Cleaner: Trojan.GenericKD.73749688
  • ESET-NOD32: MSIL/TrojanDownloader.Agent.RAO
  • Kaspersky: HEUR.MSIL.Stealer.gen
  • Microsoft: Trojan/FormBook.AFB!MTB

Indicators of Compromise (IoCs)

  • SHA256 Hash: 9ea494b525c4676e63f943e2d1dba751c377b9138613003c80d14ddfaed6883e
  • Bot Token: Associated with the Telegram bot @joemmBot
  • Distribution URLs: styxcrypter[.]com
  • Malicious TAR Archive SHA256: 088bc96742dd7eaab4563a1830b9ca74cc2fa7a933b1b89485ddfc09b18f1bae

Prevention

To safeguard against Styx Stealer:

  1. Regular Updates: Keep Windows and all installed software up-to-date, particularly applying security patches for Windows Defender.
  2. Safe Browsing Habits: Avoid clicking on links or opening attachments from unknown sources, particularly in unsolicited emails.
  3. Use Strong Security Tools: Regularly scan your system with up-to-date antivirus software capable of detecting and removing this threat.
  4. Verify Cryptocurrency Transactions: Always double-check wallet addresses before confirming cryptocurrency transactions to prevent crypto-clipping attacks.

Conclusion

Styx Stealer represents a significant threat, particularly to those involved in cryptocurrency transactions. Its ability to steal a wide range of data and its persistence on infected systems make it a formidable tool in the hands of cybercriminals. Staying vigilant and ensuring your systems are properly secured is essential to mitigate the risks posed by this malware.

Sources: