antarctida_stealer | d9e311a1bf4bc767c5d1015cd127c9b24bc2306a1d8e4d1342c5562f200c01ea

Analysis

user interaction
yes
max time kernel
23s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Antarctida_t9zcg5xhfn43.exe
Size 204KB
Sample260811-2bth4atanb
SHA256 d9e311a1bf4bc767c5d1015cd127c9b24bc2306a1d8e4d1342c5562f200c01ea
MD5 3b8ca77cb272914fbc197b992691a8dd
SHA1 c38db8214aba9f84a530a7386ed81e081c01266c
SHA512 ec6b50c9fcf0ee6704c03bc69bc50b26d74a61d41a06a7a86380509268d5e13f4fefd2e45909a1261965954cd875823734a2dcdd1b3f6387b3d5cc002815ad1c
SSDEEP 6144:03/NPEyvAbjomddWgQVPdP11blDD9g54Jbab:s/N8yv+k11blDD9gy4b
TLSH
T182244B187EC94815E5AF8AB9D4E820BA8ABDE1731542F7431897E0B61E127D0FD03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution antarctida_stealer persistence spyware stealer

Malware Config

Extracted

Family

antarctida_stealer

https://api.telegram.org/bot8950639119:AAH8eNd-9sdh0rVwAlDdgCgnropD-_MnVY0/sendMessage?chat_id=8697149202

Mutex

EWE8I7KIWJRLTHMN

Attributes

Wifi
true
bot_token
8950639119:AAH8eNd-9sdh0rVwAlDdgCgnropD-_MnVY0
browsers
true
chat_id
8697149202
crypto
false
gaming
true
grabber
true
hide
false
hosts
true
mail
true
messengers
true
mutex
EWE8I7KIWJRLTHMN
netstat
true
process_dump
true
product_key
true
screenshot
true
sockets
false
sys_info
true

Signatures

Family: AntarctidaStealer
AntarctidaStealer is an Windows stealer written in C#.
stealer antarctida_stealer

Executes dropped EXE 1 IoCs

pid	Process
3740	wMPjmUktKlHG.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yYJp4PY98Npz = "\"C:\\Users\\Admin\\AppData\\Local\\Ryd62SKv3Qqr\\wMPjmUktKlHG.exe\""	Antarctida_t9zcg5xhfn43.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wMPjmUktKlHG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_t9zcg5xhfn43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4028	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	Antarctida_t9zcg5xhfn43.exe
3980	Antarctida_t9zcg5xhfn43.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	Antarctida_t9zcg5xhfn43.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 536	3980	Antarctida_t9zcg5xhfn43.exe	83
PID 3980 wrote to memory of 2612	3980	Antarctida_t9zcg5xhfn43.exe	85
PID 2612 wrote to memory of 4028	2612	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\Antarctida_t9zcg5xhfn43.exe
"C:\Users\Admin\AppData\Local\Temp\Antarctida_t9zcg5xhfn43.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "tld7oGXiRtGG" /tr "\"C:\Users\Admin\AppData\Local\Ryd62SKv3Qqr\wMPjmUktKlHG.exe\"" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\42cd623fa0724b0ab0c0d8931ea45585.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4028

C:\Users\Admin\AppData\Local\Ryd62SKv3Qqr\wMPjmUktKlHG.exe
"C:\Users\Admin\AppData\Local\Ryd62SKv3Qqr\wMPjmUktKlHG.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wMPjmUktKlHG.exe

Path C:\Users\Admin\AppData\Local\Ryd62SKv3Qqr\wMPjmUktKlHG.exe
Size 204KB
SHA256 d9e311a1bf4bc767c5d1015cd127c9b24bc2306a1d8e4d1342c5562f200c01ea
MD5 3b8ca77cb272914fbc197b992691a8dd
SHA1 c38db8214aba9f84a530a7386ed81e081c01266c
SHA512 ec6b50c9fcf0ee6704c03bc69bc50b26d74a61d41a06a7a86380509268d5e13f4fefd2e45909a1261965954cd875823734a2dcdd1b3f6387b3d5cc002815ad1c
SSDEEP 6144:03/NPEyvAbjomddWgQVPdP11blDD9g54Jbab:s/N8yv+k11blDD9gy4b
TLSH
T182244B187EC94815E5AF8AB9D4E820BA8ABDE1731542F7431897E0B61E127D0FD03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42cd623fa0724b0ab0c0d8931ea45585.bat

Path C:\Users\Admin\AppData\Local\Temp\42cd623fa0724b0ab0c0d8931ea45585.bat
Size 131B
SHA256 a1e5278a8887bb34cb54a04dcfa9213dac86dde677284d3fb008fe47db0f26b1
MD5 a66d277f5cc6e0c9a83f89b132813bc5
SHA1 7ba47584de6ac737118f1e1cf355789a7f1b5e7b
SHA512 1fda0c587b5d4ddf58fa2decd97feee25a187d83bf925db36add234da183c7180aa3e26b7a34619690f8bbde994c27dd261f5c2fcb364078ab2d87d746c482c1
TLSH
T1C0C02B036077478C000410E50C9F32C810AF50C99D0056520607803E818B4375097EC2
MD5 SHA1 SHA512 TLSH

Submit Download

tmp4945.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4945.tmp
Size 288KB
SHA256 cda6b7ef3dde00ce9a7cd5089be6de57a28fa2c2d069731e6fd520c5517d1125
MD5 470472da2316d9f287dce04b92f0a232
SHA1 eec0557b7bd0daffa925c742c3d2fb1c8be2df1c
SHA512 f4c5c5541d3502d917e2288c2d80b39a65add6b675a60b77be0d2d6188daa8a3f5183ff9f5e4579b8856ad444fd1ff039fc3e8defe8f820a64bdb306d2dcb35c
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vd9+Cz3:f1zkVmvQhyn+Zoz6789Tz3
TLSH
T18954B902EE84F10AD71A6430CA854DF27A10AB0447816E2BDABC1E3E1EB560DBAAD585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4965.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4965.tmp
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4976.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp4976.tmp
Size 5.0MB
SHA256 1a976bd2e953b79750eec9cf3b3bb0dd594a63b90848cf50e8464dad8b23d323
MD5 d1b0d6d5e4433dfc8958b651187ae55b
SHA1 ae7dd876c455e52cf6b37de902db00646b049fc3
SHA512 0e26ea12dd6574bb30b49a152615f7f9b3bc6b3885c44daeaf1ed546e569f8836ab8676292dae7be3292bb4f2206b04e0786065d50c684c9790cd1d8a0fb5c48
SSDEEP 384:M8r54w0VW3xWpHKfKYK9KsK/a+FEQeACd4JG/U:rqVW3oVKfKYK9KsK/hFEQeACd4JG/U
TLSH
T18536231F7A205054C4EAA132EDE35F29287F701686377A933E94256D4DE0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-8-0x0000000005320000-0x0000000005370000-memory.dmp

Download

memory/3980-70-0x00000000056D0000-0x0000000005762000-memory.dmp

Download

memory/3980-5-0x0000000004A60000-0x0000000004A6A000-memory.dmp

Download

memory/3980-72-0x0000000004B70000-0x0000000004B80000-memory.dmp

Download

memory/3980-0-0x0000000000160000-0x0000000000198000-memory.dmp

Download

memory/3980-71-0x0000000005D20000-0x00000000062C4000-memory.dmp

Download

memory/3980-6-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Download

memory/3980-1-0x0000000004B70000-0x0000000004B80000-memory.dmp

Download

memory/3980-77-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/3980-78-0x0000000004B70000-0x0000000004B80000-memory.dmp

Download

memory/3980-79-0x0000000004B70000-0x0000000004B80000-memory.dmp

Download