YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader

Apr 18, 2023Ravie LakshmananThreat Intelligence / Cyber Risk

Cybersecurity researchers have detailed the inner workings of a highly evasive loader named “in2al5d p3in4er” (read: invalid printer) that’s used to deliver the Aurora information stealer malware.

“The in2al5d p3in4er loader is compiled with Embarcadero RAD Studio and targets endpoint workstations using advanced anti-VM (virtual machine) technique,” cybersecurity firm Morphisec said in a report shared with The Hacker News.

Aurora is a Go-based information stealer that emerged on the threat landscape in late 2022. Offered as a commodity malware to other actors, it’s distributed through YouTube videos and SEO-poised fake cracked software download websites.

Clicking the links present in YouTube video descriptions redirects the victim to decoy websites where they are enticed into downloading the malware under the garb of a seemingly-legitimate utility.

The loader analyzed by Morphisec is designed to query the vendor ID of the graphics card installed on a system, and compared it against a set of allowlisted vendor IDs (AMD, Intel, or NVIDIA). If the value doesn’t match, the loader terminates itself.

The loader ultimately decrypts the final payload and injects it into a legitimate process called “sihost.exe” using a technique called process hollowing. Alternatively, some loader samples also allocate memory to write the decrypted payload and invoke it from there.

“During the injection process, all loader samples resolve the necessary Win APIs dynamically and decrypt these names using a XOR key: ‘in2al5d p3in4er,'” security researchers Arnold Osipov and Michael Dereviashkin said.

Another crucial aspect of the loader is its use of Embarcadero RAD Studio to generate executables for multiple platforms, thereby enabling it to evade detection.

“Those with the lowest detection rate on VirusTotal are compiled using ‘BCC64.exe,’ a new Clang based C++ compiler from Embarcadero,” the Israeli cybersecurity company said, pointing out its ability to evade sandboxes and virtual machines.

“This compiler uses a different code base such as ‘Standard Library’ (Dinkumware) and ‘Runtime Library’ (compiler-rt) and generates optimized code which changes the entry point and execution flow. This breaks security vendors’ indicators, such as signatures composed from ‘malicious/suspicious code block.'”

In a nutshell, the findings show that the threat actors behind in2al5d p3in4er are leveraging social engineering methods for a high-impact campaign that employs YouTube as a malware distribution channel and directs viewers to convincing-looking fake websites to distribute the stealer malware.

The development comes as Intel 471 unearthed another malware loader AresLoader that’s marketed for $300/month as a service for criminal actors to push information stealers disguised as popular software using a binder tool. The loader is suspected to be developed by a group with ties to Russian hacktivism.

Some of the prominent malware families spread using AresLoader since January 2023 include Aurora Stealer, Laplas Clipper, Lumma Stealer, Stealc, and SystemBC.