SHA1:
- f7d890de0931d733d6d0a37c36bb00f0f1cc0b91
Description
Malicious C# application for Windows, obfuscated using .NET Reactor.
Operating routine
When launched, the trojan decrypts the resources it contains and launches a stealer capable of extracting accounts and data from the following applications: FoxMail, MailBird, MailMaster, MS Outlook, Filezilla, WinSCP, Steam, Discord, Pidgin, Signal, Telegram, OpenVPN, ProtonVPN, Internet Download Manager, Ngrok, OBS Studio, Opera, Firefox- and Chromium-based browsers and their extensions.
The stealer also compromises the Windows activation key.
It sends the following information to the threat actor: computer name, user name, Windows version, installed antivirus software, CPU and GPU names, RAM size, monitor model, LAN and network interface information, and cryptocurrency wallets. Additionally it takes a screenshot.
System information is sent to 95.216.99[.]206. The stealer can also exfiltrate it over the TOR network.
Mitre Matrix
| Stage | Tactic |
|---|---|
| Execution | Windows Management Instrumentation (T1047) Native API (T1106) Shared Modules (T1129) |
| Defense Evasion | Obfuscated Files or Information (T1027) Software Packing (T1027.002) Virtualization/Sandbox Evasion (T1497) |
| Credential Access | OS Credential Dumping (T1003) Unsecured Credentials (T1552) Credentials In Files (T1552.001) |
| Discovery | System Information Discovery (T1082) Software Discovery (T1518) Security Software Discovery (T1518.001) |
| Collection | Data from Local System (T1005) Screen Capture (T1113) Email Collection (T1114) |
| Command and Control | Application Layer Protocol (T1071) |
| Exfiltration | Exfiltration Over Alternative Protocol (T1048) Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001) Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) Exfiltration Over C2 Channel (T1041) |
