darkstealer

General

Target

033362225cf09b9ae543da265c7d1885.exe
Size

3.4MB
Sample

231230-vvkxqsdcg4
MD5

033362225cf09b9ae543da265c7d1885
SHA1

4d2b95b71dd92277718b54a341ba62b24c95c888
SHA256

9388288b3a18d968cd47446d545eb63d272bac65c0ad1d490beb389d94d2e9e0
SHA512

41b858735f309c938db681cd1a974dd47c7ff0fe3286f713ce50d4c7e070e64af26dd9a2dfe59f7a559d4255557d0926406c66996edb819ab466f4527349543e
SSDEEP

98304:UVrHzZ9ACjcIOrJkqn7lAmpe+oO8XuhAAe9tSys3mm:UVDzZCkcI66qn7lAmlobXuO9tSvf

Score

10^/10

Malware Config

Targets

- Target
  
  033362225cf09b9ae543da265c7d1885.exe
- Size
  
  3.4MB
- MD5
  
  033362225cf09b9ae543da265c7d1885
- SHA1
  
  4d2b95b71dd92277718b54a341ba62b24c95c888
- SHA256
  
  9388288b3a18d968cd47446d545eb63d272bac65c0ad1d490beb389d94d2e9e0
- SHA512
  
  41b858735f309c938db681cd1a974dd47c7ff0fe3286f713ce50d4c7e070e64af26dd9a2dfe59f7a559d4255557d0926406c66996edb819ab466f4527349543e
- SSDEEP
  
  98304:UVrHzZ9ACjcIOrJkqn7lAmpe+oO8XuhAAe9tSys3mm:UVDzZCkcI66qn7lAmlobXuO9tSvf
Score

10^/10

darkstealer echelon backdoor collection discovery evasion spyware stealer themida trojan
- Darkstealer
  Darkstealer is a file grabber, data stealer, and RAT.
  trojan backdoor darkstealer
- Detects Echelon Stealer payload
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Echelon - DarkStealer Fork
  Payload resembles modified variant of Echelon Stealer called DarkStealer.
  stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2