General
-
Target
033362225cf09b9ae543da265c7d1885
-
Size
3.4MB
-
Sample
231229-zas5tsdafl
-
MD5
033362225cf09b9ae543da265c7d1885
-
SHA1
4d2b95b71dd92277718b54a341ba62b24c95c888
-
SHA256
9388288b3a18d968cd47446d545eb63d272bac65c0ad1d490beb389d94d2e9e0
-
SHA512
41b858735f309c938db681cd1a974dd47c7ff0fe3286f713ce50d4c7e070e64af26dd9a2dfe59f7a559d4255557d0926406c66996edb819ab466f4527349543e
-
SSDEEP
98304:UVrHzZ9ACjcIOrJkqn7lAmpe+oO8XuhAAe9tSys3mm:UVDzZCkcI66qn7lAmlobXuO9tSvf
Malware Config
Targets
-
-
Target
033362225cf09b9ae543da265c7d1885
-
Size
3.4MB
-
MD5
033362225cf09b9ae543da265c7d1885
-
SHA1
4d2b95b71dd92277718b54a341ba62b24c95c888
-
SHA256
9388288b3a18d968cd47446d545eb63d272bac65c0ad1d490beb389d94d2e9e0
-
SHA512
41b858735f309c938db681cd1a974dd47c7ff0fe3286f713ce50d4c7e070e64af26dd9a2dfe59f7a559d4255557d0926406c66996edb819ab466f4527349543e
-
SSDEEP
98304:UVrHzZ9ACjcIOrJkqn7lAmpe+oO8XuhAAe9tSys3mm:UVDzZCkcI66qn7lAmlobXuO9tSvf
Score10/10-
Darkstealer
Darkstealer is a file grabber, data stealer, and RAT.
-
Detects Echelon Stealer payload
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon - DarkStealer Fork
Payload resembles modified variant of Echelon Stealer called DarkStealer.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-