antarctida_stealer | b5beeddf835eebf31f827795f0094f921f95a001f48e8937000e2a66778235af

General

Target
Antarcdita stealer.zip
Size 10.3MB
Sample260816-lfbk3st1e1
SHA256 b5beeddf835eebf31f827795f0094f921f95a001f48e8937000e2a66778235af
MD5 7e73d0b92fbf67f7f742a2b2a6834c44
SHA1 cf726c6895619984188958a4860e32686842e1ea
SHA512 758e01afb70f4cc381de22242ca71a98bebad0a36ebc380632ff2927b85c7452c3659dbb5940ea1b1ca9340d4cad5057528933ddde732ee7e8d982137339a290
SSDEEP 196608:q3GVsHAI5eUcoU+IrwDKgXajJIT2nVmPJyPWJsKY14f1K4bz9hjLnE7LkX5gKmni:q2XIQUdlOOajCTwV+kbE7ZpLE7LyL
TLSH
T15EB6332C51633804D708DA338EA55F3AF9C1FAD7D6819669CA1E831F06AF8D4879372D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

antarctida_stealer

Mutex

%Mutex%

Attributes

Wifi
%Wifi%
anti_debug
%AntiDebug%
anti_vm
%AntiVM%
bot_token
%BotToken%
browsers
%Browsers%
chat_id
%ChatID%
crypto
%Crypto%
ftp
%FTP%
gaming
%Gaming%
grabber
%Grabber%
hide
%Hide%
hosts
%Hosts%
mail
%Mail%
melt
%Melt%
messengers
%Messangers%
mutex
%Mutex%
netstat
%Netstat%
process_dump
%ProcessDump%
product_key
%ProductKey%
screenshot
%Screenshot%
sockets
%Sockets%
startup
%Startup%
sys_info
%SysInfo%
vpn
%VPN%
watchdog
%Watchdog%
webcam
%WebCam%

Targets

- Target
  Antarcdita stealer/Antarctida 1.0.1/AntarctidaBuilder.exe
- Size 3.8MB
- SHA256 509491c910da36d079d0833ad8a809722560c1495706af56b7f519d56ccafc48
- MD5 5b3a938202871df64430c155a39375e6
- SHA1 f26888d7c5a378a23deb527aa68e0cc27277bfa7
- SHA512 04b6306c7d1e1e79111063ccca9463d0765a249781ce00b90b8225f989b2d58e6cdd2c71b42dfa354b5306226732e78a0e34d4f0ce82a72ff33fe7cfbf730528
- SSDEEP 98304:izG07h6A9DIMZfouvU9ZeDHTkl8yU2QrJp2Y8b:hFI3UuD4fQKY8
- TLSH
  T1AB06331EE0D3998BC9376E32FCBDC153C68BAFA35267D6B1CC55C44615DFA86AA1000E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Antarcdita stealer/Antarctida 1.0.1/Stub/AntarctidaStub.exe
- Size 180KB
- SHA256 66739438d8ccdc97eaf1148504d708a4d5105c926b40f894cd98c071797e2d3e
- MD5 6dbcf37cb61445225af3f15c1f795a3b
- SHA1 599a7dd8385e193cbe2329eacf1185484be64d27
- SHA512 78c043c8906a5a2b3563854674bca0353f7d083d8e131aeea4c8479adc550edeeff846ac5e1e054ed0406369e7da3f9ec80361e24d74f6f1eb9eecfc0dd33d7f
- SSDEEP 3072:k9Y5OA2jzrrIan/BjNFSfGexQs3+p5lcXJwspePMbklowtfpHLZ9//hM5DaFQzxO:k9Y5OAArrIanZyzxQsS5lcXJNM0bkawB
- TLSH
  T15F043A0433ED8B16F2BF89B9903161994671F877A812D39E2DC518DD1E72BD0DA90FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery antarctida_stealer stealer
- Family: AntarctidaStealer
  AntarctidaStealer is an Windows stealer written in C#.
  stealer antarctida_stealer
behavioral3 behavioral4
- Target
  Antarcdita stealer/Antarctida 1.0.1/Utility/SIGTHEIF/sigthief.exe
- Size 6.4MB
- SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
- MD5 3e261becbfe12d7a5ffdbba91c76011b
- SHA1 2e5849aa0be921849f42121544895ce405fd9af1
- SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
- SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
- TLSH
  T10A66335423410CFDED6A403BC8A1991EE6D4BC53A750C56B83D48BAF2F6B6E06DBB710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: AntarctidaStealer

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6