VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion

Key Points:

• VVS stealer is a Python-based malware targeting Discord users, designed to exfiltrate sensitive information such as credentials and tokens through obfuscation techniques using Pyarmor.
• The malware impacts Discord accounts and web browsers, enabling attackers to hijack sessions, steal data, and maintain persistence on infected systems.
• Recommended actions include implementing robust monitoring for credential theft, utilizing advanced threat detection solutions, and educating users about potential phishing attempts.

Technical Details: VVS stealer employs Pyarmor for code obfuscation, making static analysis difficult. It utilizes AES-128 encryption for data protection and operates stealthily by injecting malicious JavaScript into the Discord application.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1059.007 - Command and Scripting Interpreter: JavaScript (Execution)
• T1003.001 - OS Credential Dumping: LSASS Memory (Credential Access)
• T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys (Persistence)

IOCs Mentioned:

• SHA-256 hashes:
  • 307d9cefa7a3147eb78c69eded273e47c08df44c2004f839548963268d19dd87
  • 7a1554383345f31f3482ba3729c1126af7c1d9376abb07ad3ee189660c166a2b
  • c7e6591e5e021daa30f949a6f6e0699ef2935d2d7c06ea006e3b201c52666e07
• Discord