Armorsteal Malware Analysis: Python Toolkit for Data Theft and Crypto Mining

Summary

Armorsteal is an advanced Python-based malware kit built for data exfiltration and cryptocurrency mining. It uses PyArmor to obfuscate malicious scripts and relies on a priority-based domain failover mechanism for Command and Control. The toolkit includes dedicated modules for stealing Discord tokens, browser credentials, cryptocurrency wallets, and capturing keystrokes.

Investigation

Researchers analyzed a compromised Windows host and discovered three malicious scheduled tasks referencing a Python-based malware kit stored in a system health directory. They decrypted the PyArmor-protected scripts to expose the modular behavior of the controller, miner manager, spy module, and stealer. The investigation also revealed evasion methods including cloud provider checks and automated disabling of security monitoring tools.

Mitigation

Organizations should enforce strict controls over PowerShell execution and monitor for suspicious scheduled tasks. Blocking known malicious domains and detecting unauthorized changes to Windows Defender exclusions are critical defensive measures. Restricting the use of untrusted portable Python environments can also help reduce the available attack surface.

Response

When Armorsteal activity is detected, immediately isolate the affected host to stop further data exfiltration or cryptocurrency mining. Investigate the scheduled tasks SysCheck2, SysCheckX, and SysHeal. Review Windows Defender exclusion lists for unauthorized entries and reset credentials for all accounts accessed from the compromised system.