ArmorSteal Python malware kit spread via typosquatted Chocolatey and MAS pages steals wallets and hides XMRig miner
Seqrite Labs has published an analysis of ArmorSteal, a Python-based Windows malware kit that combines credential and crypto-wallet theft, clipboard hijacking and a concealed XMRig Monero miner. The family was first documented by Zscaler ThreatLabz on 22 October 2026; the Seqrite sample is newer than that report and than an earlier June 2026 build (seqrite.com). Infection starts with typosquatted pages impersonating Chocolatey and the Microsoft Activation Scripts (lure domains choclatey[.]org and massgravel[.]net), which show a PowerShell one-liner that installs the genuine tool while dropping the kit into C:\Windows\SystemHealth\Update. The kit is operationally mature: RSA-2048-signed tasking, SHA-256-pinned downloads, 11 fallback C2 domains, cloud-sandbox evasion and Defender exclusions that survive cleanup. Risk is high for individuals and workstations, but it requires the victim to paste an untrusted PowerShell command, which limits mass exploitation.
Detalhes técnicos
The kit ships its own Python 3.11 runtime with every script protected by the trial version of PyArmor 9.1.7; Seqrite recovered the source because trial PyArmor builds embed the decryption key in the bundled runtime (seqrite.com). Persistence relies on three scheduled tasks — SysCheck2, SysCheckX and the newly observed SysHeal — two of which run as SYSTEM with no author, indicating self-registration. The controller SysMon.py derives a victim ID from the motherboard serial number, polls 11 C2 domains in priority order every 60 seconds for global and per-victim code, and executes it only if signed with the operator's RSA-2048 key. Before running, it queries ipinfo.io and exits with a fake "Memory is insufficient" error when the network owner is Google, Amazon, Microsoft or Azure, blinding many cloud sandboxes. xm_handler.py runs as SYSTEM, installs an XMRig package (downloaded as xmrig-v4-3333.zip and hash-checked, per seqrite.com) and adds C:\Windows and xmrig.exe to Microsoft Defender exclusions; it then polls for 20 monitoring tools (Task Manager, Process Explorer, Process Hacker, System Informer, Wireshark) and kills the miner within a second of one opening, restarting about a second after it closes, killing the tool instead if it stays open over an hour, and doubling reinstall delays from 2 minutes up to 6 hours if xmrig.exe is deleted. The spy module basrq.py logs keystrokes with window titles and exfiltrates every minute, polls the clipboard twice a second to swap addresses for Bitcoin, Litecoin, Ethereum, Tron, XRP, Dogecoin, TON, Solana and Monero, takes in-memory screenshots on wallet/exchange keywords, and raises fake Exodus, MetaMask and Phantom notifications (e.g. "You received 18.2 SOL") to induce wallet unlocking. The stealer got.py takes Discord tokens from four Discord apps and 18 Chromium browsers, ~20 wallet extensions and 13 desktop wallets, scans every drive for BIP-39 seed phrases of 12-25 words, and collects SSH keys and vaults from KeePass, 1Password, Bitwarden, Dashlane, RoboForm, PasswordSafe and Enpass; it defeats Chrome App-Bound Encryption by downloading the public tool ChromElevator, falling back to a fixed v0.17.4 link if the GitHub API fails. As of 31 October 2026 only pymons[.]is (186.2.175[.]158) and datamons[.]org (186.2.163[.]193) still resolved, and six of the 11 domains had no public reports; Zscaler had previously tracked the operator moving from workerstats[.]net to pymons[.]is and datamons[.]org.
Remediação
Hunt for the SysCheck2, SysCheckX and SysHeal scheduled tasks and the C:\Windows\SystemHealth\Update folder, and remove the residual C:\Windows and xmrig.exe Defender exclusions, which persist after cleanup. Review PowerShell logs for the lure domains and block all 11 C2 domains rather than a single one. Restrict software installation to verified vendor sites and prohibit pasting unvetted PowerShell commands; treat any machine that ran the installer as credential- and wallet-compromised and rotate secrets.
Linha do tempo
-
ArmorSteal Python malware kit spread via typosquatted Chocolatey and MAS pages steals wallets and hides XMRig miner
ler a análise desta fonte ocultar
Seqrite Labs has published an analysis of ArmorSteal, a Python-based Windows malware kit that combines credential and crypto-wallet theft, clipboard hijacking and a concealed XMRig Monero miner. The family was first documented by Zscaler ThreatLabz on 22 October 2026; the Seqrite sample is newer than that report and than an earlier June 2026 build (seqrite.com). Infection starts with typosquatted pages impersonating Chocolatey and the Microsoft Activation Scripts (lure domains
choclatey[.]organdmassgravel[.]net), which show a PowerShell one-liner that installs the genuine tool while dropping the kit intoC:\Windows\SystemHealth\Update. The kit is operationally mature: RSA-2048-signed tasking, SHA-256-pinned downloads, 11 fallback C2 domains, cloud-sandbox evasion and Defender exclusions that survive cleanup. Risk is high for individuals and workstations, but it requires the victim to paste an untrusted PowerShell command, which limits mass exploitation.Technical Details
The kit ships its own Python 3.11 runtime with every script protected by the trial version of PyArmor 9.1.7; Seqrite recovered the source because trial PyArmor builds embed the decryption key in the bundled runtime (seqrite.com). Persistence relies on three scheduled tasks — SysCheck2, SysCheckX and the newly observed SysHeal — two of which run as SYSTEM with no author, indicating self-registration. The controller
SysMon.pyderives a victim ID from the motherboard serial number, polls 11 C2 domains in priority order every 60 seconds for global and per-victim code, and executes it only if signed with the operator's RSA-2048 key. Before running, it queriesipinfo.ioand exits with a fake "Memory is insufficient" error when the network owner is Google, Amazon, Microsoft or Azure, blinding many cloud sandboxes.xm_handler.pyruns as SYSTEM, installs an XMRig package (downloaded asxmrig-v4-3333.zipand hash-checked, per seqrite.com) and addsC:\Windowsandxmrig.exeto Microsoft Defender exclusions; it then polls for 20 monitoring tools (Task Manager, Process Explorer, Process Hacker, System Informer, Wireshark) and kills the miner within a second of one opening, restarting about a second after it closes, killing the tool instead if it stays open over an hour, and doubling reinstall delays from 2 minutes up to 6 hours ifxmrig.exeis deleted. The spy modulebasrq.pylogs keystrokes with window titles and exfiltrates every minute, polls the clipboard twice a second to swap addresses for Bitcoin, Litecoin, Ethereum, Tron, XRP, Dogecoin, TON, Solana and Monero, takes in-memory screenshots on wallet/exchange keywords, and raises fake Exodus, MetaMask and Phantom notifications (e.g. "You received 18.2 SOL") to induce wallet unlocking. The stealergot.pytakes Discord tokens from four Discord apps and 18 Chromium browsers, ~20 wallet extensions and 13 desktop wallets, scans every drive for BIP-39 seed phrases of 12-25 words, and collects SSH keys and vaults from KeePass, 1Password, Bitwarden, Dashlane, RoboForm, PasswordSafe and Enpass; it defeats Chrome App-Bound Encryption by downloading the public tool ChromElevator, falling back to a fixed v0.17.4 link if the GitHub API fails. As of 31 October 2026 onlypymons[.]is(186.2.175[.]158) anddatamons[.]org(186.2.163[.]193) still resolved, and six of the 11 domains had no public reports; Zscaler had previously tracked the operator moving fromworkerstats[.]nettopymons[.]isanddatamons[.]org.Remediation
Hunt for the SysCheck2, SysCheckX and SysHeal scheduled tasks and the
C:\Windows\SystemHealth\Updatefolder, and remove the residualC:\Windowsandxmrig.exeDefender exclusions, which persist after cleanup. Review PowerShell logs for the lure domains and block all 11 C2 domains rather than a single one. Restrict software installation to verified vendor sites and prohibit pasting unvetted PowerShell commands; treat any machine that ran the installer as credential- and wallet-compromised and rotate secrets.