Loading malware…
26 distinct techniques documented for this family, organized by ATT&CK tactic.
As we saw in our previous research, game-related and other software lures are used to start the infection chain. Some of the detected ZIP names in these recent campaigns include: MOUSE_PI_Trainer_v1.0.zip ... TradingView-Activation-Script-0.9.zip ... Autodesk.zip
The first, sysreq.js, runs PowerShell and WMI commands to check whether the system is a real machine or a virtual one.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
Once installed on your PC, NWHStealer can: ... Achieve persistence via scheduled tasks.
The first, sysreq.js, runs PowerShell and WMI commands to check whether the system is a real machine or a virtual one.
Attackers are increasingly abusing alternative JavaScript runtimes like Bun and Deno... The returned code ... is a small eval-loop function that downloads the next stage.
In the case analyzed in this article, the infection chain starts with an archive containing Installer.exe... The Readme.txt file asks the user to manually launch dw.exe if the main .exe file fails to run properly.
The infection begins with a ZIP archive disguised as a game trainer, software crack, or utility tool.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
Once installed on your PC, NWHStealer can: ... Achieve persistence via scheduled tasks.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
Once installed on your PC, NWHStealer can: ... Achieve persistence via scheduled tasks.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
Once installed on your PC, NWHStealer can: ... Attempt to bypass User Account Control (UAC).
Strings and configurations are encrypted using XOR combined with base64 encoding, making static analysis much harder.
It spreads through Node.js scripts, MSI installers, and fake software downloads hosted on trusted platforms such as GitHub, GitLab, SourceForge, and Itch.io.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
The loader runs several PowerShell CIM (Common Information Model) commands and WMI (Windows Management Instrumentation) commands to detect virtual environments... A scoring system is implemented, and based on this score, the loader decides whether to continue with the infection or terminate it.
The first, sysreq.js, runs PowerShell and WMI commands to check whether the system is a real machine or a virtual one. It inspects CPU count, disk space, screen resolution, hardware manufacturers, and even the username, using a scoring system to decide whether to proceed with infection or stop entirely.
The loader sends a report containing the victim’s public IP, system details, and a screenshot to the C2, then fetches an AES-encrypted payload and deploys NWHStealer directly into memory with minimal traces on disk.
It collects system information, steals saved browser data and passwords...
NWHStealer is particularly concerning because of how widely it is distributed, and the types of data it targets. Stolen browser data, saved passwords, and cryptocurrency wallet information can quickly lead to account takeovers...
It collects system information, steals saved browser data and passwords...
Once inside a system, NWHStealer is highly capable. It collects system information...
The loader runs several PowerShell CIM (Common Information Model) commands and WMI (Windows Management Instrumentation) commands to detect virtual environments... A scoring system is implemented, and based on this score, the loader decides whether to continue with the infection or terminate it.
The first, sysreq.js, runs PowerShell and WMI commands to check whether the system is a real machine or a virtual one. It inspects CPU count, disk space, screen resolution, hardware manufacturers, and even the username, using a scoring system to decide whether to proceed with infection or stop entirely.
The loader sends a report containing the victim’s public IP, system details, and a screenshot to the C2...
The second file, memload.js, handles communication with the attacker’s command-and-control server.
The loader obtains and sends an initial request to the endpoint https://C2-server/api/report ... Then it makes two GET HTTP requests: https://C2-server/api/status?v={BUILD_ID} ... https://C2-server/api/update?v={BUILD_ID}
The PowerShell script takes care of... Installs Deno (a JavaScript/TypeScript runtime) via WinGet or Scoop if not present... Next, the following stage is executed with the downloaded Deno executable.
It can also inject malicious code into browser processes, bypass Windows User Account Control, persist through scheduled tasks, and pull new command-and-control addresses from Telegram to keep the operation alive after partial takedowns.
The loader obtains and sends an initial request to the endpoint https://C2-server/api/report with encrypted data about the compromised system: Public IP ... System information Anti-VM result Base-64 encoded screenshot Timestamp
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.