unix_stealer | 2ef914a44e5d9a571553062e5348ac75e165976d8e0e8ab592c4edebedb60d18

Analysis

user interaction
yes
max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build.exe
Size 296KB
Sample261026-aw2xesab29
SHA256 2ef914a44e5d9a571553062e5348ac75e165976d8e0e8ab592c4edebedb60d18
MD5 c64b6880943a195a77c12e07eb629552
SHA1 b3973fcc763e36928a61dcc8a7a3056bdeedfed1
SHA512 32bcce59150cc9486f6e54e0e43a4b26d4627ece4c9936bf9dcd3c14db08388db35d90237a17f3c66ff847c071f05c5a65546334c06d281eb22cd7e7596a113a
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUX:Hh6OTyejyThvFhIpQrAHYR/H7UX
TLSH
T1C3545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution unix_stealer ransomware spyware stealer

Malware Config

Signatures

Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
stealer unix_stealer

Detects UnixStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/5072-0-0x000002199B710000-0x000002199B760000-memory.dmp	family_unixstealer

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4076	wevtutil.exe
5984	wevtutil.exe
1744	wevtutil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	ip-api.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Build.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5032	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Build.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Build.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Build.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5416	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	Build.exe
5072	Build.exe
5072	Build.exe
5072	Build.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	Build.exe
Token: SeSecurityPrivilege	4076	wevtutil.exe
Token: SeBackupPrivilege	4076	wevtutil.exe
Token: SeSecurityPrivilege	5984	wevtutil.exe
Token: SeBackupPrivilege	5984	wevtutil.exe
Token: SeSecurityPrivilege	1744	wevtutil.exe
Token: SeBackupPrivilege	1744	wevtutil.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4076	5072	Build.exe	94
PID 5072 wrote to memory of 5984	5072	Build.exe	95
PID 5072 wrote to memory of 1744	5072	Build.exe	96
PID 5072 wrote to memory of 5032	5072	Build.exe	99
PID 5032 wrote to memory of 5416	5032	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\SYSTEM32\wevtutil.exe
  "wevtutil.exe" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 145B
SHA256 e96f4b25b92128eab425545a6017c5f890558521dfe5e3a9a23643571259ad10
MD5 72984b305d6936646c60e90688f88410
SHA1 c81d8e2fcd4efe193bbed6672eec517aa7b6693c
SHA512 249bc2d6848233840af36d00aeeedf4d90277f448bc0ebadb736661f45c3385469d824182474d7c8efd5cd7d9684f5af2754d4c66a7e91a97c5065ba37465c30
TLSH
T115C08C0352A78AAC0444A0A70ABA718C907918896E4077D00701C4A8528242EAA82651
MD5 SHA1 SHA512 TLSH

Submit Download

tmp9B0.tmp.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\tmp9B0.tmp.tmpdb
Size 5.0MB
SHA256 732c8d0e8e3cd61e047e80e3d13f599e54a93455d588a95af39b1e528f0463e6
MD5 49e0d0018b07ec52e4277c7370000f55
SHA1 b530c7ddb405c344999d66363aa26513237b23a7
SHA512 514b55448c216db026d4d12ed92bc7fbf62a3ee1e480295d8ddc729ec1e29f69711129973e100ecf616768356ae7e0b44aa66059db4fc1f6950aa6caa05bc568
SSDEEP 192:M8rJQaXoMXp0VW9FxWHVL3sQPquOvnrSZm:M8r54w0VW3xWBQpr
TLSH
T17B36000F7A201154C4DAA232ADE35F1A197F70168A3776933DA4256D4DE0723F92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp9C0.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9C0.tmp.dat
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp9E1.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9E1.tmp.dat
Size 138KB
SHA256 fee9cd831d1fc298ed6a37e5cfcca4894ed8afb8284407a14285e4c79ef6186f
MD5 f56ea3dd413a5697e3522e2f831ee97e
SHA1 930a6253a398997bab78bf0b9d120c09e70c9b2d
SHA512 6006be30bd213ba725b4a29827cb1a8784e2513681ca7e98b4f5a4c5536f7a4ea5c8fff9b148ef6358f33e723be23ce652f9284b516f2fdba01a64522be247ac
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OIpX6rWQq90VumqziwkHF:zeuvBnhJsueMEGvIW1DcP2OMz0VumNnl
TLSH
T1DFD3874B3A743002EDE59A721CE050BB5E3CB16D8F55A5D538B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp9F4.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9F4.tmp.dat
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp9F5.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp9F5.tmp.dat
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA08.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpA08.tmp.dat
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unix-ADMIN-2D06E29.zip

Path C:\Users\Admin\AppData\Roaming\Unix3679\Unix-ADMIN-2D06E29.zip
Size 589KB
SHA256 f0c6fa6c8fe130ebd6cebf0360abfdd34c8b96f62c3caf1b227fc0e6d40522b7
MD5 a0dc5dcdc389dc9eb785b3c8df992e4b
SHA1 115992b63a978efc34c8207f447163e791ea6ea2
SHA512 68c35f8abd42a3307951e53a46f40e45a01e0c613176c87d7b48005fb2592893eca58e3b9dad4e52faffe49e964acbb83fff2995a9fff845a79e562f6eb73832
SSDEEP 12288:ggrYMdurzttHlYWO4XtBh1ro80JwNEsIVb71zLaX:ggrYcC92i51r90JwNUbkX
TLSH
T17FD423A40C9B4311C1626E788CCBBFE366321A7C9FC771D5F6596AE7D434A721060E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5072-0-0x000002199B710000-0x000002199B760000-memory.dmp

Download

memory/5072-7-0x00000219B5D20000-0x00000219B5D30000-memory.dmp

Download

memory/5072-137-0x00000219B5D20000-0x00000219B5D30000-memory.dmp

Download