Bandit Stealer

Bandit Stealer is an information-stealer that employs extensive anti-VM and anti-debugging checks to evade analysis and targets a wide range of browsers, desktop and extension cryptocurrency wallets, FTP and email clients, and system artifacts to exfiltrate credentials, cookies, payment data, keystrokes and clipboard contents. Stolen data is aggregated into files under %appdata%\local (country_code + IP folder) and the malware uses Windows APIs and utilities (CryptUnprotectData, GetAdaptersAddresses, WMIC, CreateToolhelp32Snapshot) to collect system identifiers and avoid sandboxed environments.