umbral | KraxxStealer-main[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

KraxxStealer-main.zip
Size

1.2MB
MD5

73222b81f9ef5fc735a5d905a305b22d
SHA1

33135b6ca277c58df56aa490b60383c431905fa0
SHA256

68ea23c1515b2306e607ce7b124f9314b4af9ee2572e23550b3ac1a8dd3b43e6
SHA512

ae927b2882ea7244b6813534916769664cdd41d11e21b667e5b52d6194972418ff418db5e1882eb7ea47a0fb6e8ac94a773bf105e32e0d868e79b2d641b267c7
SSDEEP

24576:U1D05gOqzT1PnVlUP8TBRRtzsmE6fwdQtbF/HfKlrtE8DGuVEEv1/P:15+T17q83HzsmEqtb1KBtEqGeEEv1/P

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1304419039795216384/I-1rDDELSZUL7vdbJu9Nq2KvlQflcDT6sU5blXr4EiynR3G0o3w6M7UvOpW7sf-6-2TI

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
static1/unpack002/Kraxx-Builder/Kraxx-OS-Builder/Kraxx-Builder.exe	family_umbral

Umbral family
umbral

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Kraxx-Builder/Kraxx-OS-Builder/Kraxx-Builder.exe
unpack002/Kraxx-Builder/Kraxx-OS-Builder/Settings/TableTextService.dll
unpack002/Kraxx-Builder/Kraxx-OS-Builder/Settings/en-US/TableTextService.dll.mui
unpack002/Kraxx-Builder/Kraxx-OS-Builder/Source/WATPCSP.dll

Files

KraxxStealer-main.zip
.zip
KraxxStealer-main/Kraxx-OS.zip
.zip
Kraxx-Builder/Kraxx-OS-Builder/Kraxx-Builder.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Settings/AssemblyList_4_client.xml
Kraxx-Builder/Kraxx-OS-Builder/Settings/AssemblyList_4_extended.xml
Kraxx-Builder/Kraxx-OS-Builder/Settings/TableTextService.dll
.dll regsvr32 windows:10 windows x86 arch:x86

3eb4039a0f5ff34b8e93955306f43205

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

TableTextService.pdb

Imports

msvcrt

memcpy_s
memmove_s
memcpy
memcmp
_ftol2_sse
_putws
free
malloc
_callnewh
_XcptFilter
_amsg_exit
_initterm
_lock
_unlock
__dllonexit
_onexit
_except_handler4_common
memmove
_purecall
_vsnwprintf
memset

user32

IsWindow
InvertRect
GetSysColorBrush
GetDoubleClickTime
MessageBoxW
ToUnicode
GetKeyboardState
MapVirtualKeyW
GetKeyState
UnhookWindowsHookEx
CallNextHookEx
SetCursor
FillRect
MapWindowPoints
GetCursorPos
GetSystemMetrics
PtInRect
BeginPaint
GetDC
EndPaint
ReleaseDC
GetForegroundWindow
GetGUIThreadInfo
GetSysColor
UpdateLayeredWindow
KillTimer
SetTimer
ReleaseCapture
DrawFrameControl
SendMessageW
OffsetRect
GetClientRect
GetWindowRect
InvalidateRect
IsWindowEnabled
EnableWindow
IsWindowVisible
ShowWindow
MoveWindow
SetWindowPos
DestroyWindow
CreateWindowExW
RegisterClassW
LoadCursorW
SetWindowLongW
SystemParametersInfoW
GetMonitorInfoW
MonitorFromPoint
GetWindowLongW
SetWindowsHookExW
GetDesktopWindow
EndDialog
CreateDialogParamW
GetMessageW
PostQuitMessage
TranslateMessage
SetRect
SetCapture
DispatchMessageW
RegisterWindowMessageW
PostThreadMessageW
LoadStringW
DialogBoxParamW
GetDlgItem
DrawEdge
DefWindowProcW

advapi32

RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
IsTextUnicode
RegNotifyChangeKeyValue
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegOpenKeyW

kernel32

UnmapViewOfFile
WriteFile
SetFilePointer
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
GetConsoleMode
GetFileType
WriteConsoleW
GetStdHandle
CreateThread
GlobalFree
LoadLibraryW
ExpandEnvironmentStringsW
ResetEvent
FreeLibrary
CompareStringOrdinal
MulDiv
CreateEventW
CreateFileMappingW
GetCommandLineW
GetModuleFileNameW
LeaveCriticalSection
CreateThreadpoolTimer
MapViewOfFile
EnterCriticalSection
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
DeleteCriticalSection
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
CreateSemaphoreExW
CreateMutexExW
GetCurrentProcessId
OpenSemaphoreW
WaitForSingleObject
WaitForSingleObjectEx
ReleaseMutex
ReleaseSemaphore
CloseHandle
SetLastError
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
GetProcessHeap
HeapAlloc
GetStringTypeExW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSectionEx
GetFullPathNameW
HeapFree
LocalFree
TlsGetValue
GetCurrentThreadId
TlsSetValue
GetLastError
CompareStringW
LocalAlloc
LocalReAlloc
lstrlenW
FormatMessageW

gdi32

SetTextColor
SetBkMode
GetTextMetricsW
SelectObject
GetStockObject
CreateFontW
GetTextExtentPoint32W
DeleteDC
CreateDIBSection
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
DeleteObject
ExtTextOutW
SetBkColor

shell32

SHExtractIconsW
CommandLineToArgvW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
SysAllocString

shlwapi

ord487

msctf

TF_GetThreadMgr
TF_CreateInputProcessorProfiles
TF_CreateCategoryMgr
TF_GetInitSystemFlags

shcore

GetScaleFactorForDevice

Exports

Exports

DictionaryGeneratorW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
HELPW
HelpW
RegisterProfileW
UnregisterProfileW
helpW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 438KB - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Settings/bootmgfw.efi.mui
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:fc:d2:3b:33:1a:de:54:32:31:bf:29:62:78:20:ff:55:b2:30:00:65:04:5d:f7:2c:c7:ad:f0:b9:1f:43:d6
Signer

Actual PE Digest

85:fc:d2:3b:33:1a:de:54:32:31:bf:29:62:78:20:ff:55:b2:30:00:65:04:5d:f7:2c:c7:ad:f0:b9:1f:43:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 66KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Settings/bootmgr.efi.mui
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b6:b9:27:a6:23:22:a8:80:c3:75:15:3a:07:fb:cc:ea:38:d4:54:f1:9a:59:2c:b2:8b:4f:5d:ce:24:fb:83:3f
Signer

Actual PE Digest

b6:b9:27:a6:23:22:a8:80:c3:75:15:3a:07:fb:cc:ea:38:d4:54:f1:9a:59:2c:b2:8b:4f:5d:ce:24:fb:83:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 66KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Settings/en-US/TableTextService.dll.mui
.dll windows:10 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Settings/memtest.efi.mui
.dll windows:5 windows x86 arch:x86

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-12-2020 21:29

Not After

02-12-2021 21:29

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:4d:1a:45:ca:26:c4:9c:33:05:28:39:04:a9:53:61:24:b7:bd:59:81:c0:2d:fe:40:2f:9a:aa:2e:17:9e:74
Signer

Actual PE Digest

71:4d:1a:45:ca:26:c4:9c:33:05:28:39:04:a9:53:61:24:b7:bd:59:81:c0:2d:fe:40:2f:9a:aa:2e:17:9e:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Source/SenseTVM.exe
.exe windows:6 windows x64 arch:x64

937dde21200f58b3477c3bd1874d512d

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-02-2023 00:05

Not After

01-02-2024 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:94:87:fe:b2:a7:2b:5e:48:9c:35:c6:8e:e2:a1:d3:29:65:66:5b:ae:e5:bd:6a:09:85:54:48:f2:c6:19:10
Signer

Actual PE Digest

ad:94:87:fe:b2:a7:2b:5e:48:9c:35:c6:8e:e2:a1:d3:29:65:66:5b:ae:e5:bd:6a:09:85:54:48:f2:c6:19:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\__w\1\s\target\release\deps\axon.pdb

Imports

kernel32

LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
RtlLookupFunctionEntry
GetProcAddress
GetCurrentThread
RtlCaptureContext
GetFileInformationByHandleEx
SwitchToThread
Sleep
SetConsoleMode
CreateFileW
ReleaseSemaphore
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
CreateSemaphoreW
ReadDirectoryChangesW
CancelIo
GetModuleHandleA
GetConsoleMode
CreateEventW
GetStdHandle
HeapReAlloc
GetSystemInfo
GetProcessTimes
SetEvent
WaitForMultipleObjects
HeapFree
GetCurrentProcessId
AcquireSRWLockShared
ReleaseSRWLockShared
GetProcessHeap
FindClose
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetCommandLineW
GetFinalPathNameByHandleW
TryAcquireSRWLockExclusive
WriteConsoleW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
SetFilePointerEx
GetFileInformationByHandle
GetFullPathNameW
FindNextFileW
FindFirstFileW
ReadConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
SetConsoleCtrlHandler
GetOverlappedResult
GetExitCodeProcess
ReadFile
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeviceIoControl
SetConsoleTextAttribute
GetConsoleOutputCP
FlushFileBuffers
FreeLibrary
HeapSize
CreateSemaphoreA
LCMapStringW
CloseHandle
CompareStringW
WaitForSingleObjectEx
GetLastError
SetLastError
GetCurrentThreadId
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RtlPcToFileHeader
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW

advapi32

RegNotifyChangeKeyValue
RegEnumKeyExW
SystemFunction036
RegOpenKeyExW
RegCloseKey
EventWriteEx
EventUnregister
EventSetInformation
EventRegister
RegQueryValueExW

ntdll

NtOpenFile

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

oleaut32

SysStringLen
SysFreeString
GetErrorInfo

psapi

GetProcessMemoryInfo

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 620KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Kraxx-Builder/Kraxx-OS-Builder/Source/ThirdPartyNotice
Kraxx-Builder/Kraxx-OS-Builder/Source/WATPCSP.dll
.dll windows:10 windows x64 arch:x64

080c6172cab0357d8c5679fe93afe968

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

WATPCSP.pdb

Imports

msvcp_win

?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??Bid@locale@std@@QEAA_KXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o_free
_o_malloc
_o_memcpy_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleHandleExA

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
CreateMutexExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
SleepEx
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoTaskMemFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventActivityIdControl
EventUnregister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegGetValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
QueryServiceConfig2W

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-sysinfo-l1-2-1

InstallELAMCertificateInfo

propsys

InitVariantFromFileTime

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KraxxStealer-main/README.md

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 227KB - Virtual size: 226KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

3eb4039a0f5ff34b8e93955306f43205

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

advapi32

kernel32

gdi32

shell32

ole32

oleaut32

shlwapi

msctf

shcore

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 167KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 438KB - Virtual size: 438KB

.reloc Size: 8KB - Virtual size: 7KB

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

85:fc:d2:3b:33:1a:de:54:32:31:bf:29:62:78:20:ff:55:b2:30:00:65:04:5d:f7:2c:c7:ad:f0:b9:1f:43:d6Signer

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 66KB - Virtual size: 68KB

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b6:b9:27:a6:23:22:a8:80:c3:75:15:3a:07:fb:cc:ea:38:d4:54:f1:9a:59:2c:b2:8b:4f:5d:ce:24:fb:83:3fSigner

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 66KB - Virtual size: 68KB

Headers

DLL Characteristics

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 176B

.rsrc Size: 7KB - Virtual size: 8KB

Code Sign

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:edCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

71:4d:1a:45:ca:26:c4:9c:33:05:28:39:04:a9:53:61:24:b7:bd:59:81:c0:2d:fe:40:2f:9a:aa:2e:17:9e:74Signer

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 35KB - Virtual size: 36KB

.text
Size: 227KB - Virtual size: 226KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 168KB - Virtual size: 167KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 438KB - Virtual size: 438KB

.reloc
Size: 8KB - Virtual size: 7KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

85:fc:d2:3b:33:1a:de:54:32:31:bf:29:62:78:20:ff:55:b2:30:00:65:04:5d:f7:2c:c7:ad:f0:b9:1f:43:d6
Signer

.rsrc
Size: 66KB - Virtual size: 68KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b6:b9:27:a6:23:22:a8:80:c3:75:15:3a:07:fb:cc:ea:38:d4:54:f1:9a:59:2c:b2:8b:4f:5d:ce:24:fb:83:3f
Signer

.rsrc
Size: 66KB - Virtual size: 68KB

.rdata
Size: 512B - Virtual size: 176B

.rsrc
Size: 7KB - Virtual size: 8KB

33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

71:4d:1a:45:ca:26:c4:9c:33:05:28:39:04:a9:53:61:24:b7:bd:59:81:c0:2d:fe:40:2f:9a:aa:2e:17:9e:74
Signer

.rsrc
Size: 35KB - Virtual size: 36KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

ad:94:87:fe:b2:a7:2b:5e:48:9c:35:c6:8e:e2:a1:d3:29:65:66:5b:ae:e5:bd:6a:09:85:54:48:f2:c6:19:10
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 620KB - Virtual size: 620KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 42KB - Virtual size: 41KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 22KB - Virtual size: 21KB

.text
Size: 108KB - Virtual size: 106KB