Full Report
Group-IB discovers new information stealer targeting Vietnam with rare functionality to filter out Facebook accounts with advertising credits
Analysis Summary
# Tool/Technique: VietStealer
## Overview
VietStealer is a specialized information stealer malware discovered by Group-IB, primarily targeting users in Vietnam. Its primary purpose is to exfiltrate sensitive data from web browsers, with a highly specific and rare focus on hijacking Facebook accounts that possess active advertising credits or are associated with business management tools.
## Technical Details
- **Type:** Malware family (Information Stealer)
- **Platform:** Windows
- **Capabilities:** Browser credential harvesting, cookie theft, Facebook advertising credit filtering, automated exfiltration via Telegram.
- **First Seen:** Approximately late 2023 / early 2024 (based on Group-IB discovery).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
- T1539 - Steal Web Session Cookie
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
- T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage (Telegram API)
## Functionality
### Core Capabilities
- **Credential Harvesting:** Extracts saved usernames and passwords from various Chromium-based and Gecko-based browsers.
- **Cookie Theft:** Steals session cookies to bypass Multi-Factor Authentication (MFA) and gain direct access to active sessions.
- **System Metadata Collection:** Gathers hardware information, IP addresses, and geolocation data from the infected host.
- **Telegram C2:** Uses the Telegram Bot API as a Command and Control (C2) mechanism to send stolen data logs directly to the threat actors.
### Advanced Features
- **Facebook Advertising Filter:** Unlike generic stealers, this malware includes scripts specifically designed to query the Facebook Graph API. It checks if the compromised account has:
- Active Facebook Ads Manager accounts.
- Linked payment methods (Credit cards/PayPal).
- Remaining advertising credits or high daily spend limits.
- Roles in Facebook Business Manager.
- **Localized Targeting:** The malware and its distribution campaigns are specifically tailored to the Vietnamese language and digital ecosystem.
## Indicators of Compromise
### File Hashes (SHA256)
* 71c4d0fc03bc4e083f64b2f80b2242618fb725efd64f362446f98c6d2051834f
* b5621b540d1ca1dd802397822145ae4f80e96e59b81fdc8d0a7b18919ceadd12
* 17598536cf0bac6cb0d589410682e2cd9f813ea52bc931fe85292b149dbeb659
* 20ac10ea3a964c25f09b0008406388cf4195828eed6daaeda139c55ce84986f4
* 8c6e6faa28f67ac56587a4dcea49c820b466113604900c3f829185a096c6df47
### Network Indicators
* api[.]telegram[.]org (Used for exfiltration)
* graph[.]facebook[.]com (Used for account attribute filtering)
### Behavioral Indicators
* Unexpected outbound HTTPS traffic to Telegram API from non-messaging processes.
* Access attempts to sensitive browser files (e.g., `Login Data`, `Cookies`) by unsigned or suspicious executables.
## Associated Threat Actors
- Unknown (Likely Vietnam-based or targeting-focused cybercriminals specializing in social media marketing fraud).
## Detection Methods
- **Signature-based detection:** Deploying the provided SHA256 hashes to EDR and AV solutions.
- **Behavioral detection:** Monitoring for unauthorized access to browser profile folders (`%LocalAppData%\Google\Chrome\User Data\Default`).
- **Network Monitoring:** Alerting on high-frequency requests to the Facebook Graph API from end-user workstations that are not associated with authorized marketing tools.
## Mitigation Strategies
- **Browser Security:** Encourage the use of dedicated password managers instead of saving credentials within the browser.
- **Session Security:** Implement short session timeouts for sensitive business platforms like Facebook Business Manager.
- **Access Control:** Use hardware security keys (FIDO2) which are more resistant to cookie theft/session hijacking than SMS or app-based MFA.
- **User Education:** Train employees (especially marketing staff) to recognize phishing attempts delivering malicious attachments disguised as invoices or marketing reports.
## Related Tools/Techniques
- **Ducktail:** Another malware family targeting Facebook Business accounts in Southeast Asia.
- **NodeStealer:** A similar stealer focused on hijacking Facebook business accounts using Node.js environments.