Resubmissions
10/08/2026, 12:45
260810-py2f1ahn3w10/08/2026, 12:43
260810-pxz7jsgc281021/01/2026, 11:25
260121-nh98jaas4e1021/01/2026, 11:19
260121-ne3paahy8a1021/01/2026, 10:53
260121-my7lxagw9c10Analysis
- user interaction
yes - max time kernel
20s - max time network
24s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/08/2026, 12:43
General
- Target snos & dox soft.exe
- Size 296KB
- Sample260810-pxz7jsgc28
- SHA256 7378b14368a4b8bcbddffffee744f95c57593a355b7a602eb6c2ca24d439ea94
Score
10/10
Malware Config
Signatures
- Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
- Detects UnixStealer payload 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\snos & dox soft.exe"C:\Users\Admin\AppData\Local\Temp\snos & dox soft.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
memory/4232-0-0x000002621F290000-0x000002621F2E0000-memory.dmp
memory/4232-1-0x00000262398A0000-0x00000262398B0000-memory.dmp
memory/4232-93-0x00000262398A0000-0x00000262398B0000-memory.dmp