ACRStealer Leverages Google Docs and Steam for C2 Server via DDR Technique

AhnLab Security Intelligence Center (ASEC) has reported a significant resurgence of the ACRStealer infostealer, a threat that has evolved rapidly since its inception and now demonstrates advanced detection evasion, analysis obstruction, and communication techniques.

Actively distributed since early this year, ACRStealer has not only maintained its robust information theft capabilities, but also integrated several sophisticated mechanisms to bypass traditional monitoring and countermeasures, making it a formidable adversary in the threat landscape.

Command-and-Control Techniques

One of the most notable technical advancements in the latest ACRStealer variants is the use of the Heaven’s Gate technique, which allows the execution of x64 shellcode within WoW64 processes.

This method, while primarily leveraged for service-type malware, disrupts conventional behavioral analysis engines due to its ability to mask malicious activity from both host-based and hypervisor-based detection modules.

Departing from common C2 communication libraries such as WinHTTP and Winsock, ACRStealer engages directly with the AFD (Ancillary Function Driver) through the use of low-level Windows NT system calls, including NtCreateFile and NtDeviceIoControlFile.

This deliberate tactic, likely inspired by the open-source project “NTSockets,” enables the malware to construct and control its own HTTP traffic, effectively circumventing network security tools that rely on API monitoring or proxy inspection at the DLL level.

Further complicating the detection process, the malware often manipulates the HTTP request headers by hardcoding mismatched hostnames and IP addresses.

In some cases, ACRStealer uses the names of reputable domains such as microsoft.com, avast.com, facebook.com, google.com, and pentagon.com as decoys, even though the actual C2 communications are made with IPs not linked to those domains.

Such obfuscation routines can mislead network monitoring software, causing benign domains to show up in traffic logs, thereby hampering effective threat hunting and response.

Advanced Data Exfiltration

ACRStealer has also exhibited progressive improvements in its exfiltration and configuration management routines.

For configuration and data exchange, earlier versions used simple Base64 and RC4 encryption with a static RC4 key ("852149723\x00"), transmitting configuration data from the C2 server using HTTP/HTTPS.

While initial implementations concealed C2 endpoints within CloudFlare infrastructure, this approach later shifted to avoid restrictions on header manipulation and the use of self-signed certificates for HTTPS communication.

The latest strains of ACRStealer employ AES-256 in CBC mode for all C2-bound data exfiltration and configuration retrieval.

Both the AES key (7640FED98A53856641763683163F4127B9FC00F9A788773C00EE1F2634CEC82F) and Initialization Vector (55555555555555555555555555555555) are embedded in the binary, ensuring confidential transmission.

Furthermore, the C2 communication paths have become dynamic and randomized, with the server assigning unique endpoints for each victim session via an initial JSON handshake, complicating signature-based network detection even further.

Despite the changes in transport and evasion, ACRStealer’s core capabilities such as the theft of browser credentials, cryptocurrency wallet data, cloud storage and email/FTP account information, as well as sensitive documents have persisted across versions.

According to the Report, The malware’s delivery mechanisms facilitate the installation of secondary payloads, expanding its destructive potential.

Recent industry updates indicate a rebranding of ACRStealer to “AmateraStealer” according to research by ProofPoint, with the variant positioned as one of the most active and adaptable infostealer strains in the wild.

Continuous development, evasion innovation, and infrastructure variability necessitate heightened vigilance and timely defense measures from both enterprise and individual users.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.