Abstract

We analyze “commodity” malware kits advertised on a darknet marketplace accessible at awazonmphskqrqr5fquam*************.onion/auth/login. Listings attributed to the vendor brand “TRIO / TrioGram” include (i) VENOM RAT v2.7 – Extreme (remote access trojan), (ii) PEGASUS RAT (RAT with HVNC/hidden browser capability), and (iii) BLACKNET v3/v3.5 (multi-purpose botnet/stealer with source). We characterize the kits at a capability level, then perform a deep technical dive on the information-stealer component common to this ecosystem. We map behaviors to ATT&CK techniques, outline distribution and command-and-control (C2) patterns, and quantify the downstream economy (log shops, access brokerage, fraud crews) including indicative price bands and margins. Defensive sections include detection analytics (host and network), environment hardening, and incident response guidance. This paper is strictly descriptive for defensive and research purposes; it omits deployment instructions.

1. Introduction and Marketplace Context

Access vector. The observed shop operates on Tor at the onion URL given above. Access requires Tor; payment is in cryptocurrency (Monero/Bitcoin/Litecoin/BCH). Listings advertise escrow and large “stock” counts—typical trust signals in criminal marketplaces.

Actor/brand. The vendor identity “TRIO / TrioGram” presents multiple “digital” products:

• VENOM RAT v2.7 – Extreme: classical Windows RAT (remote desktop/control, file management, keylogging, persistence, credential harvesting).

• PEGASUS RAT: RAT plus HVNC (Hidden VNC) and “hidden browsers,” enabling headless interaction with a victim’s desktop/browser to bypass device fingerprinting, 2FA fatigue thresholds, and geo controls.

• BLACKNET v3/v3.5 (source): multi-purpose crimeware (password/cookie theft, screenshots, keylogger, clipboard/crypto address hijack, DDoS, remote script execution) backed by a web panel.

Taxonomy. These kits sit in the “commodity crimeware” stratum: low unit price, high volume, and interchangeable features. Typical deliverables are (1) a builder that outputs a Windows payload, (2) a web panel (often PHP/MySQL) for C2 and log aggregation, and (3) minimal documentation. Distribution (“traffic”) is left to buyers or affiliated “traffer” crews.

2. Methods and Scope

• Collection: Marketplace observation and artifact enumeration from listings/screen captures. No purchases or live deployment were performed.

• Scope: We emphasize behaviors and ecosystem linkages, not kit-specific exploitation details. Any configuration specifics that would directly facilitate misuse are intentionally omitted.

• Limitations: Self-reported feature sets are marketing claims; real capabilities frequently diverge. Backdoored or re-packed variants are common.

3. Threat Model and Capability Overview

3.1 Capability families

• RAT: remote control, surveillance (keylogging/screencap), file ops, lateral tool staging.

• Stealer: credential/cookie/session token exfiltration from browsers and apps; autofill PII; clipboard hijacking for crypto.

• Botnet: centralized tasking (DDoS, payload delivery, spam), update/uninstall, and bulk telemetry.

3.2 ATT&CK mapping (representative)

4. Case Study: Information-Stealer Architecture and Operations

4.1 Reference architecture

1. Loader/Stub. User-mode Windows PE. Common traits: anti-VM checks, delayed execution, environment probing, optional AMSI bypass, and signed-binary proxying (LOLBINs such as rundll32, regsvr32, or mshta as child processes).

2. Persistence Layer. Registry Run/RunOnce keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), Scheduled Tasks, Startup folder implants, or WMI permanent event consumers.

3. Collection Modules.

   • Browser stores: SQLite DBs (Login Data, Cookies, Web Data) for Chromium family; equivalent Firefox profiles (logins.json, key4.db). Access frequently gated by DPAPI; malware either (a) uses OS APIs under current user context or (b) exfiltrates protected blobs for offline decryption.

   • Session Tokens: Cookie jars and local storage yielding reusable authenticated sessions (cloud, email, social, exchange, retailer).

   • Autofill/PII: Names, addresses, phone numbers; occasionally saved card metadata (less common with modern browser protections).

   • Crypto Artifacts: Clipboard monitors to regex-match address formats; wallet directories for desktop clients; plaintext seed phrases in user documents (opportunistic).

   • Keylogger & Screen Capture: Low-frequency capture to complement credential theft and support hands-on fraud.

4. Packaging/Metadata. Host fingerprinting (hostname, username, locale, IP/ASN, OS build). Artifacts aggregated as ZIP/7z; naming conventions embed host/time.

5. Exfiltration. HTTPS POST/PUT to panel endpoints; alternative channels include Telegram/Discord bots or “dead-drop” paste services. Some kits multiplex to multiple endpoints for redundancy.

6. Tasking (optional). C2 can push commands: update/uninstall, execute scripts, enable HVNC/hidden browser, or deliver second-stage payloads (e.g., miners, ransomware).

Why cookies matter. Modern operations focus on session tokens rather than passwords, enabling friction-free account takeover (ATO) without triggering MFA re-enrollment. Token theft is the decisive feature across contemporary stealers.

4.2 Distribution vectors

• Malspam: Archive/executable attachments, HTML smuggling, link-based delivery to staging sites.

• Malvertising/SEO poisoning: Fake download portals for “cracks,” drivers, game mods; traffic monetized via install brokers.

• Social drops: Discord/Telegram channels distributing “tools” or media.

• Bundlers: Trojanized installers chained to adware loaders.

4.3 Victimology

• Consumer endpoints (high volume): extensive browser stores and weak hygiene; frequent overlap with crypto usage.

• SMBs (medium value): SaaS admin, VPN, and billing portals often saved in browsers.

• Privileged users (low volume, high value): RMM, CSP consoles, CI/CD, and repository access.

4.4 Data products harvested

• Auth material: Passwords, cookies, tokens, OAuth refresh tokens, device fingerprints.

• Identity graph: Autofill PII, contact data, phone/address history.

• Financial/crypto: Exchange sessions, wallet hints, clipboard events.

• Environment: Locale/geo/ASN for pricing and prioritization by brokers.

4.5 Evasion and durability

• Crypting/packing cycles to chase AV/EDR deltas.

• Living-off-the-land invocation to blend execution chains (browser child processes launched by non-interactive parents).

• Stealth UI (HVNC/hidden browsers) to perform risk-scored transactions on the victim device, defeating device-binding controls.

5. The Underground Supply Chain and Monetization

5.1 Roles and interactions

• Developers: sell builders/panels; sometimes operate private C2s embedded as backdoors.

• Crypters: obfuscation “as a service,” offered per build/month with “FUD” guarantees.

• Traffers/Install brokers: acquire traffic and push installs; bill per thousand installs (geography/AV-pass dependent).

• Operators/Loggers: run panels, triage data, and either exploit or resell.

• Log Shops/Brokers: retail raw logs (ZIPs) or parsed credentials by site/geo/freshness.

• Initial Access Brokers (IABs): extract enterprise footholds and auction them to intrusion/ransomware crews.

• Cashers/Fraud crews: convert access into value (refund fraud, gift cards, crypto withdrawals, ad fraud, mule operations).

5.2 Channels

• Tor shops for retail purchases of kits and bulk logs.

• Telegram/Discord for invite-only auctions, automation bots, and support.

• Closed forums for reputation-based trades, escrow, and vetting.

5.3 Price bands and unit economics (indicative)

• Kits: USD $20–$150 (stealer/RAT); source or “lifetime” at higher tiers.

• Crypter services: $30–$300/month.

• Traffic/installs: a few USD to >$100 per 1,000 successful installs depending on GEO and AV evasion.

• Raw stealer logs: sub-$1 to $15 in bulk; “premium” logs (fresh Tier-1 + banking/crypto/cloud) $20–$200+ each.

• Enterprise access (IAB): tens to thousands of USD based on privilege/sector.

• Return on Crime (ROC): ATO of a single high-balance exchange/merchant account can amortize the entire campaign cost; stale or low-quality logs approach zero value.

5.4 OPSEC and exposure

• Compartmentalization: per-campaign wallets, domains, VPS, and personas.

• Payment hygiene: preference for privacy-oriented coins; nonetheless deanonymization occurs at cash-out or via clustering.

• Attribution leakage: reused C2 strings, PDB paths, builder mutexes, hosting overlaps, and support channels tie campaigns together.

• Interdiction vectors: undercover buys, sinkholes, blockchain tracing, registrar/hosting cooperation, and endpoint telemetry.

6. Defensive Analytics and Controls

6.1 Host-based analytics (behavioral)

Browser store access at scale

• Monitor non-browser processes reading/writing:

  • Chromium: %LOCALAPPDATA%\Google\Chrome\User Data\*\Login Data, Cookies, Web Data, Local State

  • Edge/Brave/Opera analogs; Firefox profiles (logins.json, key4.db)

• Alert on rapid, sequential access to multiple browser stores in <60s by the same PID tree.

Hidden/Headless browser activity

• Parent process anomalies: non-interactive processes spawning chrome.exe, msedge.exe, firefox.exe with windows not surfaced.

• Command-line indicators: off-screen or minimized flags; profile redirection into temp paths.

Persistence creation

• New Run keys/Startup entries with random GUID-like names.

• Scheduled tasks with incongruent authors or misaligned creation times.

Clipboard hijack heuristics

• Processes hooking clipboard APIs and performing regex checks for crypto address formats shortly after a copy event.

File staging and compression

• Short-lived archives (ZIP/7z) generated in %TEMP% or profile dirs containing browser DB files and host metadata.

6.2 Network analytics

• Beaconing to newly registered or DDNS domains over HTTPS with small, periodic POSTs.

• Unexpected use of Telegram/Discord API endpoints/proxies from workstation processes.

• TLS SNI/JA3 mismatches relative to user activity; anomalous user-agent strings from non-browser parents.

6.3 Example (defender) detections (pseudocode)

Sigma-style (host, Windows)

Zeek/Proxy (network)

6.4 Hardening and prevention

• Application control: deny unknown EXEs/DLLs from user-writable paths; block LOLBIN abuse as child from Office/archives.

• Browser policy: separate admin vs. user profiles; minimize persistent cookies; enforce re-auth for sensitive actions; prefer passkeys/FIDO2 over passwords.

• Egress controls: block DDNS, disallow Telegram/Discord APIs from corporate endpoints, restrict outbound to allow-listed destinations.

• Email/Web: attachment detonation, HTML smuggling detection, ad-block and safe-search enforcement; monitor for SEO-poisoned download domains.

6.5 IR and recovery (when a stealer is suspected)

1. Isolate host; acquire volatile data if feasible.

2. Token-centric response: revoke browser and OAuth sessions; rotate API keys and refresh tokens—don’t rely solely on password resets.

3. Hunt for lateral movement: RDP/VPN logs, cloud audit (OAuth grants, new MFA enrollments, inbox rules).

4. Telemetry export: archive suspicious archives, process trees, and network flows for retro-hunt/YARA/Sigma tuning.

5. User remediation: credential hygiene, browser profile rebuild, hardware-bound MFA re-provisioning.

7. Risks Specific to RAT/HVNC Tooling

• Device-bound fraud: HVNC enables “from-device” logins that score as low risk by anti-fraud models.

• Session riding: stolen cookies + hidden browser complete sensitive flows (banking, exchanges) without OTP prompts if tokens remain valid.

• Staging for hands-on intrusion: RAT modules provide the foothold used by ransomware affiliates and data-theft crews.

8. Ethics and Research Safety

• Isolation: analyze only within disconnected, instrumented sandboxes; use synthetic data; sinkhole any C2.

• Legal constraints: possession/distribution/use of these binaries can violate law and contracts; coordinate with counsel and leadership.

• Attribution hygiene: do not contact sellers; avoid interactions that fund criminal activity.

9. Conclusion

The observed Tor listings exemplify a mature, commoditized market where low-cost builders and panels abstract away malware development. The decisive innovation is token theft + invisible interaction (HVNC/hidden browsers), which shifts value from credentials to sessions and device reputation. Defenders should emphasize token lifecycle controls, browser store monitoring at the OS layer, and egress governance for consumer-grade APIs from enterprise endpoints. The monetization chain—from traffers to IABs—means even “small” stealer infections can seed higher-impact compromises; detection and response must assume that cookie theft equals compromise.

---

Appendix A — Practical Hunt Ideas (Defender-Only Heuristics)

• Multi-store sweep: alert when a single PID reads both Chromium and Firefox credential stores within 60s.

• Clipboard regex tripwire: alert on processes that read clipboard and immediately write a similar-length string matching Bech32/Base58 patterns.

• HVNC/hidden UI: detect creation of alternate window stations/desktops by non-admin processes; correlate with network flows to unfamiliar hosts.

• ZIP staging: flag creation of archives within %TEMP% containing Login Data + Cookies + host info files; tie to subsequent outbound POSTs.

Ask for a demo NOW.