Understanding Anivia Stealer: A New Threat in Cybersecurity

A novel piece of information-stealing malware named Anivia Stealer is gaining traction on underground forums, primarily marketed by a threat actor associated with the handle ZeroTrace. This malware represents a significant advancement in the realm of credential theft, designed to infiltrate a wide range of Windows systems, from older Windows XP versions to the latest Windows 11.

Technical Aspects of Anivia Stealer

Developed using the C++17 programming language, Anivia Stealer is equipped with sophisticated evasion techniques that make it particularly dangerous. Its design enhances its capability to exfiltrate sensitive data, posing substantial threats to both individual users and corporate networks alike.

Evading Security Warnings

One of the critical features highlighted in Anivia’s marketing is its ability to bypass User Account Control (UAC) mechanisms. This allows the malware to execute actions that typically require administrative approval without raising red flags for users. Its automatic elevation techniques effectively permit the software to perform privileged operations quietly, which is alarming given that UAC is a critical safeguard in the Windows operating system.

Pricing and Accessibility

Recent research from KrakenLabs has revealed that Anivia Stealer is marketed on various cybercriminal marketplaces through a subscription model. Prices range from €120 for a one-month access plan to €680 for lifetime access. This pricing strategy indicates a calculated approach to attract both amateur and seasoned cybercriminals looking to leverage this tool.

Targeted Data

Anivia Stealer is intended to harvest an extensive range of sensitive information, including:

• Browser credentials
• Authentication cookies
• Cryptocurrency wallet information
• Messaging tokens
• Local Security Authority (LSA) credentials
• Screenshots of the operating system

This range of targeted data underscores the severity of the threat, particularly for individuals and businesses handling sensitive information.

Communication and Updates

The malware communicates via encrypted channels with its command-and-control (C2) infrastructure, adding another layer of complexity for detection measures. Furthermore, it boasts automatic update capabilities, helping it evade detection signatures that would typically alert security systems.

Links to Other Malware

On the threat intelligence front, there are indications that Anivia Stealer may either be a rebranded version or a fork of a previously identified malware variant called ZeroTrace Stealer. Observations of the GitHub commit history and other developer metadata suggest that both Anivia and ZeroTrace share an origin linked to the same malicious figure, who has also been associated with another notorious malware, Raven Stealer.

UAC Bypass Mechanism

How It Works

At the core of Anivia Stealer’s effectiveness is its implementation of UAC bypass techniques. The malware exploits various privilege escalation techniques within Windows to gain automatic elevation without requiring any user input. By circumventing one of Windows’ primary security protocols, Anivia can infiltrate protected system areas and access sensitive data, including cached credentials stored in registry hives and memory locations that typically would be off-limits.

Implications for Security

The claim that Anivia does not require any external dependencies is significant. This self-contained approach minimizes forensic artifacts and simplifies deployment across various target environments, making detection by security software considerably more difficult.

Conclusion

As Anivia Stealer begins to garner attention amongst cybercriminals, its advanced features and ability to bypass critical security measures present serious implications for individual users and organizations. Given its capacity to extract a wide array of sensitive information, combined with the sophisticated methods it uses to evade detection, staying informed about such threats is vital. Enhanced awareness and proactive security measures will be essential in combating this emerging malware.