darkstealer

General

Target

eafd60610c62cf0ffd94bd168c68bab0084f9a1b4d737262392d23eb4428ad11
Size

2.4MB
Sample

220306-1247vaffg5
MD5

32bef1e15011ae8f2e5b8b0ee40f947a
SHA1

6dad2a93b9487f0ea6caf96ddb8130fc3023bd7d
SHA256

eafd60610c62cf0ffd94bd168c68bab0084f9a1b4d737262392d23eb4428ad11
SHA512

528425df1243b8b8a4f66de94de7d50a31ecb4b4937800e44815ce3a70fe637228de5bcc0c6bf23590d656f77fc749b02b863d9e2417f30c848589fb43ec0167

Score

10^/10

Malware Config

Targets

- Target
  
  eafd60610c62cf0ffd94bd168c68bab0084f9a1b4d737262392d23eb4428ad11
- Size
  
  2.4MB
- MD5
  
  32bef1e15011ae8f2e5b8b0ee40f947a
- SHA1
  
  6dad2a93b9487f0ea6caf96ddb8130fc3023bd7d
- SHA256
  
  eafd60610c62cf0ffd94bd168c68bab0084f9a1b4d737262392d23eb4428ad11
- SHA512
  
  528425df1243b8b8a4f66de94de7d50a31ecb4b4937800e44815ce3a70fe637228de5bcc0c6bf23590d656f77fc749b02b863d9e2417f30c848589fb43ec0167
Score

10^/10

darkstealer echelon backdoor collection discovery evasion spyware stealer trojan
- Darkstealer
  Darkstealer is a file grabber, data stealer, and RAT.
  trojan backdoor darkstealer
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Echelon - DarkStealer Fork
  Payload resembles modified variant of Echelon Stealer called DarkStealer.
  stealer
- Echelon log file
  Detects a log file produced by Echelon.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2