Researchers spotted brand new info on Invicta Stealer 2023, dubbed being promoted by its developer on Facebook, leveraging the social media platform to connect with consumers and promote the stealer on sale.

Invicta Stealer Invicta Stealer 2023 machine and hardware facts to recognize about the place of the target.

their time area, and the language on the device Vishwa Pandagle by means of Vishwa Pandagle May 26, 2023 – updated on May additionally 31, 2023 in Firewall every day, Malware news
zero Invicta Stealer 2023.

Interestingly, the danger actor had additionally created a YouTube channel to suggest the Invicta stealer. numerous instances of the use of the Invicta Stealer had been found due to its builder availability on Invicta Stealer 2023 www.blackhatpakistan.net

you may also like Invicta Stealer 2023.

NoName goals Lithuania Aviation region, Claims Avion express, Heston airlines Cyber assault
Cyber Espionage group Strontium Stealer Launches far off get right of entry to Trojan LithiumRAT
Toyota Motor customer statistics Leak: harm Deeper Than anticipated, Says organization
Endorsement of the Invicta Stealer 2023.

accelerated usage charge of the Invicta Stealer 2023 (image: Cyble)

besides FB, YouTube, and GitHub, its developer supplied an unfastened stealer builder to boom its reputation and entice consumers. some YouTube users have published high-quality opinions on the platform approximately the data stealer.

Invicta Stealer 2023 developers make the most of Facebook to promote Malware
How the Invicta Stealer 2023 is sent to a consumer
customers have despatched an unsolicited mail e-mail with an HTML page connected to it. The HTML web page is designed to appear to be money back invoice from GoDaddy. whilst the fraudulent refund HTML page is opened, a Discord page is opened which downloads another document named bill.zip.

The zip document carries a shortcut record named INVOICE_MT103.Ink. It requires the user to open the .lnk document which triggers a PowerShell command.

Invicta stealer 2023
infection chain of Invicta stealer 2023 (image: Cyble)

Researchers from the Cyble Research & Intelligence Labs analyzed a 64-bit GUI binary of the Invicta stealer 2023 from the wild to discover greater approximately it. Following is the info determined –

Its SHA256 hash is 067ef14c3736f699c9f6fe24d8ecba5c9d2fc52d8bfa0166ba3695f60a0baa45.
It has encrypted strings to hide its records.
It makes use of SYSCALLS for its operations.
It employs multithreading to perform a couple of duties simultaneously.
records were stolen using Invicta Stealer 2023

Invicta Stealer 2023 steals machine and hardware records to know approximately the region of the goal, their time quarter, and the language of the device.

The hardware records it requires have been discovered to be major memory size, a wide variety of CPU cores, display screen resolution, hardware identity, IP cope with, and Geo IP information.

Invicta stealer 2023 steals the subsequent touchy machine information:
computer name
device username, time area, and language
working machine model
Names of jogging strategies
hardware statistics
The stolen facts from the Invicta stealer are mixed in a textual content file named sys_info.txt and stored in the memory to be despatched to the hackers behind the operation. After the gathering all the statistics from the device, it briefly stores it within the system’s memory.

Invicta creates a compressed zip file with a random call with the hardware identification as shown beneath:

The report is despatched to the C&C server or Discord webhook which the hacker makes use of to create additional attacks which include stealing money from their wallets and banks and developing greater relevant phishing emails with the target’s information.

targets of the Invicta stealer 2023.

Discord – it’s miles after stealing all the required facts from the target, Invicta seems to the presence of the Discord software on the system to scouse borrow facts from it.
Wallets – It appears for wallets on the gadget. it is able to thieve from over 25 wallets as stated inside the Cyble weblog. a number of them are Neon, Zcash, VERGE, WalletWasabi, Exodus, Bitcoin, Coinomi, Dogecoin, Electrum, Litecoin, and so forth.

Browsers – After looking for wallet data, the information stealer appears for browser information for credit card information, browser history, keywords, login statistics, and many others. Over 30 browsers have been cited on the Cyble weblog that may be accessed by way of this records stealer. a number of them are Chromium, Yandex, Vivaldi, Opera Neon, 360Browser, Microsoft Side, BraveSoftware, Google Chrome, and so forth.

Steam – The gaming utility Steam is accessed to thieve lively gaming periods, usernames, games established, and so on.
KeyPass password manager – This password manager that might incorporate passwords for websites and programs is likewise hacked by means of the Invicta stealer to gain credentials.
lack of statistics and privacy Invicta Stealer 2023

The statistics stealer is equipped to steal most records from the maximum locations of a device which makes it vital to be detected and prevented at the beginning glance of a phishing electronic mail. Catchy subjects such as refunds are used by hackers to make users suppose it’s miles about an incoming credit.

A put-up made on might also thirteen via the vendor of Invicta stealer 2023 wrote, “If we created a reasonably-priced subscription (up to $50-80 in step with month, in comparison to other stealers charging $one hundred fifty) which featured a web panel, could you operate our product?”

“in case you vastly unfold malware, send us a message as we have a proposition to help you make manner more money from your logs. Please don’t bother messaging us if you don’t know what you’re doing, have a low traffic, or don’t target cryptocurrencies,” the post further studies.