antarctida_stealer | 6e170bf3012d8c67c642848a419fe8c8e45f08b539c93e1336d5e4676345e771

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Antarctida_6zfop9lzgy14.exe
Size 178KB
Sample260808-bvtp4aba83
SHA256 6e170bf3012d8c67c642848a419fe8c8e45f08b539c93e1336d5e4676345e771
MD5 1be8b93a01f879eee9c32455039d07e9
SHA1 b4f977a07f79d90058a991f987418b39690729f7
SHA512 d58f8a73c14b1921e7bfa39b5b35b1141492ec79f3bbc3beb0109a9f372a15b57b28be937d54dbc0a476c2e3e15d31522e63fa46c12346a3461cd86d8d60277b
SSDEEP 3072:EeMvBpouEe+EEMKcOk7r0lSta3b8d0x5zVQHMsbRbklowtfpHDNAPmJ/hM5tNAvh:PMvBpouEe+EEMKDk7PKUCzVUJbRbkaw
TLSH
T14E044A5423FD4B12F2FF99B5D43411894A72F877A816D78F2D8128DD1AB2B80DA44FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution antarctida_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

antarctida_stealer

Mutex

9T6NLAFAZ6XVRJQ7T5PI5WKK99GXVOF3ZXFLR5R5DGJ5NGCLV27Q6SQOJ74XI3A3

Attributes

Wifi
true
anti_debug
false
anti_vm
false
bot_token
MTUzNTQ1ODEzNDI5NzAxODM3OQ.Gj2cgK.UaDl1yW77G-GLwemknuTxAyjhM5p2xVeXBdc5k
browsers
true
chat_id
1489351764561100944
crypto
true
ftp
true
gaming
true
grabber
true
hide
false
hosts
false
mail
true
melt
false
messengers
true
mutex
9T6NLAFAZ6XVRJQ7T5PI5WKK99GXVOF3ZXFLR5R5DGJ5NGCLV27Q6SQOJ74XI3A3
netstat
true
process_dump
false
product_key
true
screenshot
true
sockets
true
startup
true
sys_info
true
vpn
true
watchdog
true
webcam
true

Signatures

Family: AntarctidaStealer
AntarctidaStealer is an Windows stealer written in C#.
stealer antarctida_stealer
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Antarctida_6zfop9lzgy14.exe
Key queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Antarctida_6zfop9lzgy14.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Antarctida_6zfop9lzgy14.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7kvENQbEF1PI = "\"C:\\Users\\Admin\\AppData\\Local\\26WXovERAusW\\tMRYXsdDAyy9.exe\""	Antarctida_6zfop9lzgy14.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
14	api.ipify.org
15	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_6zfop9lzgy14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2364	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4304	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4304	netstat.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
816	Antarctida_6zfop9lzgy14.exe
816	Antarctida_6zfop9lzgy14.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	Antarctida_6zfop9lzgy14.exe
Token: SeDebugPrivilege	4304	netstat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2132	816	Antarctida_6zfop9lzgy14.exe	88
PID 816 wrote to memory of 2364	816	Antarctida_6zfop9lzgy14.exe	91
PID 816 wrote to memory of 4304	816	Antarctida_6zfop9lzgy14.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Antarctida_6zfop9lzgy14.exe

C:\Users\Admin\AppData\Local\Temp\Antarctida_6zfop9lzgy14.exe
"C:\Users\Admin\AppData\Local\Temp\Antarctida_6zfop9lzgy14.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:816
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "3HBiNZgIdzFK" /tr "\"C:\Users\Admin\AppData\Local\26WXovERAusW\tMRYXsdDAyy9.exe\"" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2132
- C:\Windows\SysWOW64\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2364
- C:\Windows\SysWOW64\netstat.exe
  "netstat.exe" -ano
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp433A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp433A.tmp
Size 288KB
SHA256 dbb214ef12c779d014afeb8914e4958ab5f5c215ae7c41804525a8dcd60edad0
MD5 aa1a70a28ec9bf822e6714d52fb4e0ff
SHA1 41a1b38173af27663fc8989ed8e44e767e55ffb7
SHA512 2db797e3a6170ee94081fc360e280fd04fe9efb7b882266ddcac0aca40758cf9f78debe00bcbc579b4438d2f6d356cc637a0ebf449a84c4e9756e72c8c2dfee5
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vadd9+Cax:f1zkVmvQhyn+Zoz67fd9Tax
TLSH
T14254AF02EDC4B10AD71E7430CA455EF33A01AB0853915E2BDBBC1E3E5E7164DBAAD5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp435A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp435A.tmp
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp436B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp436B.tmp
Size 5.0MB
SHA256 d7b31d834cba515ffef6f0e4e65e5043394c828462561bf6f0f90b8a289e644c
MD5 48a6d56c9b913786e536ed25f7a7be2e
SHA1 f258411e88ba9584b6db3c242ecce4a9bef41508
SHA512 b01ffb4fa304f7d6ff94e7dbf4fdf58113ab832856e0b220fdb40c417becfb54a734ab60e6f75fcecc659b5b640f0d1ddf1c425f6256e8fc069c0cd9e7f47c02
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8g:M8rJQaXoMXp0VW9FxWHg7snuQXT/Zm
TLSH
T1D836111F7A202150C4EAA232ADE35F19183F74169A3776933EA4256D4DD0723B92DCFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-0-0x0000000000FC0000-0x0000000000FF2000-memory.dmp

Download

memory/816-1-0x0000000005A70000-0x0000000005A80000-memory.dmp

Download

memory/816-4-0x0000000003470000-0x000000000347A000-memory.dmp

Download

memory/816-5-0x00000000034A0000-0x00000000034B2000-memory.dmp

Download

memory/816-6-0x00000000061A0000-0x00000000061F0000-memory.dmp

Download

memory/816-71-0x0000000006620000-0x00000000066B2000-memory.dmp

Download

memory/816-72-0x0000000006C70000-0x0000000007214000-memory.dmp

Download

memory/816-74-0x0000000007290000-0x00000000072F6000-memory.dmp

Download