unix_stealer | 45fd70793d0f8523f9aaeae429f7e51d8e7dd00bb05273a12a4c2022c46745d0

Resubmissions

27/05/2026, 16:53

260527-vd9jrsft5x

27/05/2026, 16:50

260527-vclfjsfs7v10

Analysis

max time kernel
298s
max time network
295s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 296KB
Sample260527-vclfjsfs7v
SHA256 45fd70793d0f8523f9aaeae429f7e51d8e7dd00bb05273a12a4c2022c46745d0
MD5 ebc4b7e92fe88d9d3085b8b54429c8db
SHA1 3baa401f27b2393a7044f6b1cd20e2ba662c591e
SHA512 3da87a735a90c3d971530bb7315b4ba2a09554a61cf93697d5a88277a143b44b7a3b21c8ada1c300ac1b6ed2818155d4f48990262f43b579661d88912e926ff4
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUG:Hh6OTyejyThvFhIpQrAHYR/H7UG
TLSH
T166545C0127ED4659F2FF6BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery unix_stealer ransomware spyware stealer

Malware Config

Signatures

Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
stealer unix_stealer

Detects UnixStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3196-0-0x000002F10AB60000-0x000002F10ABB0000-memory.dmp	family_unixstealer

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4376	wevtutil.exe
2320	wevtutil.exe
4112	wevtutil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Loader.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4432	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3196	Loader.exe
3196	Loader.exe
3196	Loader.exe
3196	Loader.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	Loader.exe
Token: SeSecurityPrivilege	4112	wevtutil.exe
Token: SeBackupPrivilege	4112	wevtutil.exe
Token: SeSecurityPrivilege	2320	wevtutil.exe
Token: SeBackupPrivilege	2320	wevtutil.exe
Token: SeSecurityPrivilege	4376	wevtutil.exe
Token: SeBackupPrivilege	4376	wevtutil.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4376	3196	Loader.exe	81
PID 3196 wrote to memory of 2320	3196	Loader.exe	82
PID 3196 wrote to memory of 4112	3196	Loader.exe	83
PID 3196 wrote to memory of 1704	3196	Loader.exe	86
PID 1704 wrote to memory of 4432	1704	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 146B
SHA256 0fe7075e902db7be5b75e4aebda1932693cefec901fa5383fdfcb000d165cd1d
MD5 67717d0830e7d3baad88028644b9d37b
SHA1 96a763b2d750dd89e8d3f507ff53b7ef98742e7b
SHA512 ee907d38b71d834c200c63107180e0bdc9b186f146d58ab4e39ef1bcbd94d18e634f5404fe4dfdb41c027f37e5a50836916303518b498b8b7b65a1e2d71890f5
TLSH
T1D8C08C0352EB8BA90440A02709BAB08CA07A18CA2E45B7D10B01C0A852C242FEA82B11
MD5 SHA1 SHA512 TLSH

Submit Download

tmp213C.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp213C.tmp.dat
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp214F.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp214F.tmp.dat
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3196-0-0x000002F10AB60000-0x000002F10ABB0000-memory.dmp

Download

memory/3196-1-0x000002F126030000-0x000002F126040000-memory.dmp

Download

memory/3196-40-0x000002F126030000-0x000002F126040000-memory.dmp

Download