Criminals provide Ginzo stealer for free, now it is gaining traction

We discovered and announced Ginzo stealer^[1] on March 24, 2022. A Youtube video, discovered by @3xp0rtblog, showcases the first release. It was uploaded on 4th of March.

The description below the video states that the stealer is provided for free, which is most likely a marketing technique to get criminal buyers hooked.

If that is a marketing technique, it has worked well for the criminals. Just counting the samples we saw between 20th and 30th of March, we found more than 400 Ginzo stealer binaries on VirusTotal.

Ginzo's Telegram channel states that the stealer is for sale by now.

Ginzo stealer is obfuscated with ConfuserEx resulting in error messages when trying to decompile the code.  That is because the type initializer .cctor decrypts the actual code on the fly. It also initializes data required for string decryption.

Automatic deobfuscation with tools like de4dot is not sufficient anymore. A combination of debugging (to obtain the decrypted code and strings), static analysis and manual deobfuscation is necessary to obtain readable code.

Ginzo stealer first downloads the following additional libraries from its C&C server:

• Newtonsoft.Json.dll
• BouncyCastle.Crypto.dll
• SQLite.Interop.dll for x86 and x64
• System.Data.SQLite.dll
• DotNetZip.dll

Due to improper exception handling the stealer crashes some time later if these libraries cannot be downloaded.

The stealer requests a ginzolist.txt from the C&C server. This text file contains addresses of additional download locations for executables. In our tests the file contained two entries that instruct Ginzo to download antiwm.exe^[2] and generation.exe^[3]. The file antivm.exe is a malicious coinminer and generation.exe is another .NET based stealer, specializing on Discord tokens. Both of these files are packed.

Ginzo creates a folder named GinzoFolder in %LOCALAPPDATA% (see picture below). It stores all the extracted system data there, like screenshots, credentials, cookies, telegram data, and cryptocurrency wallets. The stealer creates a file named System.txt to store generic system information, which includes the IP address, operating system, username, computername, screen resolution, graphics card, processor, RAM, launch time and the Ginzo stealer telegram channel. The stealer also stores a datetime value in ChromeUploadTime.txt for making sure that the stolen data is not sent too often to the threat actor.

A listing of GinzoFolder contents and contained data is in the IoC section at the bottom.