unix_stealer | 45fd70793d0f8523f9aaeae429f7e51d8e7dd00bb05273a12a4c2022c46745d0

Resubmissions

27/05/2026, 16:53

260527-vd9jrsft5x

27/05/2026, 16:50

260527-vclfjsfs7v10

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 296KB
Sample260527-vclfjsfs7v
SHA256 45fd70793d0f8523f9aaeae429f7e51d8e7dd00bb05273a12a4c2022c46745d0
MD5 ebc4b7e92fe88d9d3085b8b54429c8db
SHA1 3baa401f27b2393a7044f6b1cd20e2ba662c591e
SHA512 3da87a735a90c3d971530bb7315b4ba2a09554a61cf93697d5a88277a143b44b7a3b21c8ada1c300ac1b6ed2818155d4f48990262f43b579661d88912e926ff4
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUG:Hh6OTyejyThvFhIpQrAHYR/H7UG
TLSH
T166545C0127ED4659F2FF6BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery unix_stealer ransomware spyware stealer

Malware Config

Signatures

Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
stealer unix_stealer

Detects UnixStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/4988-0-0x00000146444E0000-0x0000014644530000-memory.dmp	family_unixstealer

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3300	wevtutil.exe
3828	wevtutil.exe
3428	wevtutil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Loader.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3508	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4988	Loader.exe
4988	Loader.exe
4988	Loader.exe
4988	Loader.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	Loader.exe
Token: SeSecurityPrivilege	3828	wevtutil.exe
Token: SeBackupPrivilege	3828	wevtutil.exe
Token: SeSecurityPrivilege	3300	wevtutil.exe
Token: SeBackupPrivilege	3300	wevtutil.exe
Token: SeSecurityPrivilege	3428	wevtutil.exe
Token: SeBackupPrivilege	3428	wevtutil.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3828	4988	Loader.exe	103
PID 4988 wrote to memory of 3428	4988	Loader.exe	104
PID 4988 wrote to memory of 3300	4988	Loader.exe	105
PID 4988 wrote to memory of 3144	4988	Loader.exe	108
PID 3144 wrote to memory of 3508	3144	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 146B
SHA256 0fe7075e902db7be5b75e4aebda1932693cefec901fa5383fdfcb000d165cd1d
MD5 67717d0830e7d3baad88028644b9d37b
SHA1 96a763b2d750dd89e8d3f507ff53b7ef98742e7b
SHA512 ee907d38b71d834c200c63107180e0bdc9b186f146d58ab4e39ef1bcbd94d18e634f5404fe4dfdb41c027f37e5a50836916303518b498b8b7b65a1e2d71890f5
TLSH
T1D8C08C0352EB8BA90440A02709BAB08CA07A18CA2E45B7D10B01C0A852C242FEA82B11
MD5 SHA1 SHA512 TLSH

Submit Download

tmpD692.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpD692.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpD6A5.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpD6A5.tmp.dat
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4988-0-0x00000146444E0000-0x0000014644530000-memory.dmp

Download

memory/4988-17-0x00000146463B0000-0x00000146463C0000-memory.dmp

Download

memory/4988-40-0x00000146463B0000-0x00000146463C0000-memory.dmp

Download