Executive Summary
A comprehensive analysis reveals the emergence of Hannibal Stealer, an evolved version of the Sharp Stealer family. The malware is a modular .NET infostealer designed to harvest high-value credentials, browser data, and cryptocurrency assets. It employs a variety of evasion techniques including geofencing (avoiding CIS countries), DLL injection, and obfuscated configuration blobs to bypass traditional security controls.
The technical analysis highlights a robust attack chain involving process injection, asynchronous data collection, and multi-channel exfiltration via Telegram and private C2 servers. Its capabilities extend to specialized theft of VPN configurations from CyberGhost, NordVPN, and ExpressVPN, as well as clipboard hijacking specifically targeting Bitcoin and other cryptocurrency addresses. Given its integration of LOLBAS and runtime API resolution, this threat poses a significant risk to personal and enterprise financial data.
The actor 'Bedrettinortaak' has claimed development of this malware in public forums. Organizations should focus on monitoring suspicious .NET execution, unauthorized access to browser AppData directories, and unusual network traffic to Telegram API endpoints.