Extracted

Extracted

• • Target
    https://github.com/DNClub/Ultimate-Stealer-Collection/blob/main/%21%20Source%20Codes/Amnesia/AmnesiaStealer.7z

  Score

  10^/10

  wacollectioncredential_accessdefense_evasiondiscoveryexecutionredlinesentinel_stealerxorium_stealerinfostealerpersistenceprivilege_escalationspywarestealer

  • Detects SentinelStealer in memory

  • Detects XoriumStealer payload

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SentinelStealer

    SentinelStealer is an information stealer written in C#.

    stealersentinel_stealer

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1