darkstealer

General

Target

faee06a90a9cbbff9407ced9494fd7c3_JaffaCakes118
Size

3.3MB
Sample

240419-xbkhzadb5y
MD5

faee06a90a9cbbff9407ced9494fd7c3
SHA1

c580e0907ef1bb5b5728a53beec4db14bc153625
SHA256

34f27154b9594d049db97fa647be0bcef4228bed786e21f4899ca0da3e0874f7
SHA512

a83d279b26106e8921b15f8f5db88d28567e975b4980f52958d7f19db130b19ecf43f979817c4d3c99ebddabdef1104ba22fd23f4e31c255d1f87f9e8c214ba2
SSDEEP

98304:SVuD8LsOi4HhOqylicerYxyQHWjv41ABa8ep:SVe8L5Oqz7cB71ABa8q

Score

10^/10

Malware Config

Targets

- Target
  
  faee06a90a9cbbff9407ced9494fd7c3_JaffaCakes118
- Size
  
  3.3MB
- MD5
  
  faee06a90a9cbbff9407ced9494fd7c3
- SHA1
  
  c580e0907ef1bb5b5728a53beec4db14bc153625
- SHA256
  
  34f27154b9594d049db97fa647be0bcef4228bed786e21f4899ca0da3e0874f7
- SHA512
  
  a83d279b26106e8921b15f8f5db88d28567e975b4980f52958d7f19db130b19ecf43f979817c4d3c99ebddabdef1104ba22fd23f4e31c255d1f87f9e8c214ba2
- SSDEEP
  
  98304:SVuD8LsOi4HhOqylicerYxyQHWjv41ABa8ep:SVe8L5Oqz7cB71ABa8q
Score

10^/10

darkstealer echelon backdoor evasion spyware stealer themida trojan
- Darkstealer
  Darkstealer is a file grabber, data stealer, and RAT.
  trojan backdoor darkstealer
- Detects Echelon Stealer payload
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Echelon - DarkStealer Fork
  Payload resembles modified variant of Echelon Stealer called DarkStealer.
  stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Echelon Stealer payload

Echelon

Echelon - DarkStealer Fork

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2