antarctida_stealer | Antarctida_0iez3r7dvoke[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Antarctida_0iez3r7dvoke.exe
Size 256KB
Sample260810-p4cd3ahn9x
SHA256 182c0121dde56822a0f5c534d9255a65d6939cca77ea4547cff89642774f32ae
MD5 7b47a8e5bc4786401eac79235a3a0ea9
SHA1 26ffe7037ade486638295075bba02917caf4b761
SHA512 63a4fb966895a2e2946162f80cecf9e3c3549b64632ea4bbd6deeacb3fd33a6bc26031c4a2a11c1d475b4d4b952be5b97d05ae805b03ad8c1c71222089861140
SSDEEP 6144:CEUPkyTGPWxZbEnLKSPXryb0vgbttfnedqDNSl:rU8yTgK8X+b0vut/qqZO
TLSH
T15A444B283AC95816E66FCE70D5E820FA89BEE1636545F75B14A3D1A20E027C0FD83D77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer antarctida_stealer

Malware Config

Extracted

Family

antarctida_stealer

Mutex

3FBJ1HOTYPRIUF6Z24AO2CY9JULRX9SCTQLVPZQD68P7GN67UPQRSU9EP6T35FOC

Attributes

Wifi
true
bot_token
MTUzNTUzMzM2NDY1NDkwMzMyNw.GC00TX.zkSSnoV2fCJiKctcOcji5lp4RezMHb1D5AYYpY
browsers
true
chat_id
1377275097433243738
crypto
true
gaming
true
grabber
true
hide
true
hosts
true
mail
true
messengers
true
mutex
3FBJ1HOTYPRIUF6Z24AO2CY9JULRX9SCTQLVPZQD68P7GN67UPQRSU9EP6T35FOC
netstat
true
process_dump
true
product_key
true
screenshot
true
sockets
true
sys_info
true

Signatures

Family: AntarctidaStealer
AntarctidaStealer is an Windows stealer written in C#.
stealer antarctida_stealer

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Antarctida_0iez3r7dvoke.exe

File Explorer

Antarctida_0iez3r7dvoke.exe

.exe 256KB

Antarctida_0iez3r7dvoke.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 182c0121dde56822a0f5c534d9255a65d6939cca77ea4547cff89642774f32ae
MD5 7b47a8e5bc4786401eac79235a3a0ea9
SHA1 26ffe7037ade486638295075bba02917caf4b761
SHA512 63a4fb966895a2e2946162f80cecf9e3c3549b64632ea4bbd6deeacb3fd33a6bc26031c4a2a11c1d475b4d4b952be5b97d05ae805b03ad8c1c71222089861140
SSDEEP 6144:CEUPkyTGPWxZbEnLKSPXryb0vgbttfnedqDNSl:rU8yTgK8X+b0vut/qqZO
TLSH
T15A444B283AC95816E66FCE70D5E820FA89BEE1636545F75B14A3D1A20E027C0FD83D77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

56:3a:c6:d8:79:e0:9d:ef:d3:2b:ed:7f:6b:1d:43:a9:11:15:c8:64:8c:44:6c:5d:ff:c8:c2:2f:d0:b2:b7:37

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=155694934,CN=nordvpn s.a.,O=nordvpn s.a.,STREET=PH F&F Tower\, 50th Street & 56th Street\, Suite 32-D,L=Panama City,ST=Panama,C=PA,1.2.840.113549.1.9.1=#0c1161646d696e406e6f726476706e2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13025041,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:b3:ab:95:b8:9d:4a:e0:90:60:8b:4a

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 14, 2021 - May 14, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

249278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Antarctida_0iez3r7dvoke.exe

PE Signature issue

mscoree

dotnet