Remove Glove Stealer trojan

Glove Stealer is a malware that aims to steal users’ information, specifically information from browsers and extensions. Written in .NET, this malware is a very serious infection that targets cookies, login credentials, cryptocurrency data, authentication extensions, password managers, etc. The amount of information it could steal is very troubling, particularly because the infection could go unnoticed for a while.

 

 

Glove Stealer is able to steal a wide range of information but is not particularly sophisticated in order regards, suggesting that it could still be in development. Nonetheless, an infection could lead to serious issues, including hijacked accounts and drained cryptocurrency wallets.

When the malware is initiated, before it proceeds to steal data, it kills several processes, specifically processes that contain the brave, browser, chrome, chromium, opera, yandex, and CryptoTab strings. It looks for certain files in applications related to login data, cookies, web data, etc. Stolen data is compressed into a ZIP file, encrypted, and then sent to a command-and-control (C&C) server. Stolen data can be used for a variety of different purposes or sold to other cybercriminals. Whether the stolen data will be used by malware operators themselves or sold to other cybercriminals will eventually lead to the same result, hijacked sensitive accounts (emails, social media, personal accounts, etc.), and even drained cryptocurrency wallets.

The fact that Glove Stealer could also steal information from multi-factor authentication extensions means it could grant operators access to even secure accounts. Stealing passwords from a password manager would give them easy access to many accounts.

Overall, Glove Stealer is a very serious infection, albeit not a very sophisticated one at the moment. It is currently detected by many anti-virus programs so users whose computers are protected should not have any issues with data theft as the infection would be stopped before it could do anything.

How does Glove Stealer infect users’ devices?

At the moment, Glove Stealer is being distributed via phishing emails that contain HTML attachments. When users click on the attachment, a fake error message is displayed, and it says that the content could not be rendered correctly. The error message offers instructions on how users can supposedly solve the issue and render the content correctly.

Users are instructed to copy a malicious script and run it in a Run prompt or terminal. After several scripts and a PowerShell command are executed, the malware is initiated.

Emails with malicious attachments remain one of the most common methods of malware distribution, which is why it’s so important to learn how to recognize malicious emails and not open unsolicited email attachments without double-checking first. While sophisticated malicious emails can be difficult to identify, attachments can and should be scanned with an anti-malware program or a service like VirusTotal before they are opened. Anti-malware software should also be enabled on a computer at all times so that infections are caught before they can do anything.

How to remove Glove Stealer trojan from your computer

It is a very serious malware infection, which means you should remove Glove Stealer using an anti-malware program. Without a security program, it may be difficult to even detect the infection. And if you try to delete Glove Stealer manually, you could end up causing more damage to your device.

Glove Stealer is detected as:

• Win32:Glove-B [Pws] by Avast/AVG
• Trojan.Generic.37076525 by BitDefender
• A Variant Of MSIL/Spy.Agent.CVT by ESET
• HEUR:Trojan-PSW.MSIL.Typhon.gen by Kaspersky
• Trojan:Win32/Wacatac.B!ml by Microsoft
• Generic.Malware/Suspicious by Malwarebytes

Because this infection is a stealer malware, if it was present on your computer at one point, you need to secure all of your accounts from a malware-free device. It may be best to believe that all login information has been stolen and change all passwords immediately.