High-level findings

1. File type
   • 32-bit Windows PE executable (GUI / WinMain, built with MSVC 2019).
   • No exports except the entry-stub; clearly intended to be run, not a library.

2. Purpose
   The program is an information stealer focused on: • Chromium-based browsers (Chrome, Edge, Brave, Vivaldi, Opera GX, etc.).
   • Firefox / Waterfox.
   • Crypto-currency desktop wallets (Exodus, Binance, Electrum, Jaxx, ElectronCash, …).
   • Browser crypto-wallet extensions (MetaMask, Ronin, Keplr, Yoroi, dozens of others).
   • Generic “important files” from the user’s Desktop.

3. Exfiltration
   • Uses WinInet to POST a multipart/form-data request to:
   http://evetesttech[.]net [blocked] (boundary string “91jkpa01sjqrty192”).
   • Data is first archived to c:\ProgramData\winrarupd.zip, then removed after upload.

4. Main control flow (simplified) entry → __scrt_common_main_seh → FUN_0040951A

   FUN_0040951A:

   1. Anti-analysis / single-instance check (FUN_0040501F, FUN_00401061).
   2. Prepare working directory (FUN_00408E60).
   3. For each target path it calls FUN_00404E17 to copy / harvest files:
      “Wallets/Exodus”, “…/Ethereum\keystore”, “%LocalAppData%\Google\Chrome\…”, …
   4. Browser data stealing:
      • Chromium: SQL queries for logins, cookies and autofill (strings visible).
      • Decrypts os_crypt.encrypted_key using Crypt32.
      • Firefox: loads bundled nss3/mozglue/freebl3/softokn3 to decrypt logins.json / cookies.sqlite.
   5. Crypto-wallet extension hunter (FUN_00407934): looks for each extension ID listed in .rdata.
   6. Builds the ZIP archive, sends it (FUN_0040CD7F), wipes the file, exits.

5. Network / C2 artefacts • Domain: evetesttech[.]net (plain HTTP).
   • User-Agent not hard-coded; HTTP/1.1 header and multipart template visible.
   • Field names: “fname”, “c:\ProgramData\winrarupd.zip”.

6. Indicators of compromise Files/directories created or touched:
   • %ProgramData%\winrarupd.zip
   • %ProgramData%\sqlite3.dll, freebl3.dll, softokn3.dll, mozglue.dll, nss3.dll (bundled NSS libs).
   • %ProgramData%\config.txt (noted in strings).
   Outbound traffic to evetesttech.net on port 80 with multipart/form-data boundary “91jkpa01sjqrty192”.

7. Risk assessment • Steals saved website logins, cookies, autofill PII.
   • Steals crypto-currency wallets and browser extension secrets.
   • Sends data unencrypted over HTTP → easy for attacker but also for third-party sniffing.
   • Cleans up some artefacts, making casual forensic analysis harder.

Recommendations for defenders

1. Block / sinkhole evetesttech.net (and monitor past DNS resolutions).
2. Add hash & YARA signatures for the ZIP name and boundary string to email/web proxies.
3. Search endpoints for %ProgramData%\winrarupd.zip and the bundled NSS DLL paths.
4. Revoke any credentials stored in browsers on infected hosts; rotate cryptocurrency wallet seeds.
5. Restore affected machines from a known-good image; the stealer does not persist but exfiltrated data is already compromised.

Hashes (for this sample) SHA-256: 05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1
(MD5/SHA-1 available on request)

Let me know if you want deeper disassembly of a particular routine, a YARA rule, or IOC list in a different format.

──────────────────────────────────────────────────────────── Comprehensive Malware-Analysis Report
Sample SHA-256 : 05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1
Build time-stamp : 2023-02-22 13:48:25 UTC (linker)
Examined on : <today’s date>
────────────────────────────────────────────────────────────

1. Executive summary The specimen is a 32-bit PE information-stealer written in C / C++ and compiled with MSVC 2019.
   Its only purpose is to harvest: • Saved credentials, cookies and autofill data from Chromium-based and Gecko (Firefox) browsers.
   • Desktop and browser crypto-currency wallets (files & browser-extension stores).
   • “Interesting” plaintext files from the desktop.
   Stolen material is zipped to C:\ProgramData\winrarupd.zip and then streamed in clear-text HTTP (multipart/form-data) to evetesttech[.]net, after which the archive is deleted.
   The malware is non-persistent and intended to be a smash-and-grab implant.

2. File details • Type : PE32 executable (GUI / WinMain).
   • Subsystem : Windows GUI, no console.
   • Compiler : MSVC 19.29 (Visual C++ 2019).
   • Imports : KERNEL32, ADVAPI32, WININET (dynamically loaded); statically linked CRT.
   • TLS : none.
   • Packers : none (plain).
   • Exports : only “entry” thunk.
   • .rsrc section carries a minimal UAC manifest (asInvoker).

3. Static analysis 3.1 Interesting strings (abridged) • C2 : “http://evetesttech.net”
   • Upload boundary : “91jkpa01sjqrty192”
   • Temporary archive : “c:\ProgramData\winrarupd.zip”
   • Chrome SQL queries :
   – “SELECT origin_url,username_value,password_value FROM logins”
   – “SELECT host_key,name,encrypted_value,path,is_secure,expires_utc FROM cookies”
   – “SELECT name,value,count FROM autofill”
   • Firefox paths : bundled “nss3.dll, mozglue.dll, softokn3.dll, freebl3.dll”
   • Massive hard-coded list of wallet-extension IDs (≈50).

3.2 Segment sizes
.text = 0x207FF, .rdata = 0x9920, .data = 0x1554 → no obvious obfuscation/packing.

3.3 Imports used for anti-sandbox & anti-debug
IsDebuggerPresent, VirtualQuery (shellcode detection), GetSystemTimeAsFileTime (timing).

4. Relevant internal functions (symbolic names are ours) address name purpose ──────────────────────────────────────────────────────── 0040951A → main_controller() Entry after CRT; orchestrates theft & exfil. 0040501F anti_analysis() Mutex / anti-debug / single-instance checks. 00401061 prepare_workdir() Creates %ProgramData% staging directory. 00408E60 create_archive_dir() Returns ZIP staging path. 00404E17 collect_path(wchar *dst,int) Recursively copies matching files into loot-dir. 00407934 collect_wallet_extensions() Detects installed Chrome extensions by ID. 004089FB grab_chromium() DB copy → DPAPI decryption → text dump. 00408E1A grab_firefox() Uses embedded NSS libs for decryption. 00408161 grab_desktop_wallets() Exodus, Electrum, Jaxx, etc. 00404BFF enumerate_browsers() Iterates through Chrome, Edge, Brave, Opera… 00409D14 enumerate_firefox_profiles() Handles profiles.ini parsing. 0040CD7F exfiltrate_zip() WinInet POST to C2, deletes file on success.

5. Behavioural overview 5.1 Startup & self-defence • Verifies not running inside a debugger (IsDebuggerPresent, timing gaps).
   • Creates “winrarupd” working directory in %ProgramData% and sets current process working dir.
   • Optionally checks GetComputerNameA to avoid repeat infections.

5.2 Information theft modules a) Chromium family
• Reads ‘Local State’ → extracts & DPAPI-decrypts “os_crypt.encrypted_key”.
• Copies ›Login Data‹, ›Cookies‹, ›Web Data‹ DBs, runs the above SQL queries.
• Dumps results into plaintext .txt files.

b) Firefox family
• Drops bundled NSS runtime in %ProgramData% and loads it with LoadLibraryExW.
• Calls NSS_Init and decrypts logins.json base64 blobs.
• Queries cookies.sqlite / formhistory.sqlite directly.

c) Crypto-wallet extensions (Chrome)
• Hard-coded list of extension IDs (MetaMask, Ronin, Keplr, …).
• If %UserData%\Extension ID\ is present, the folder is copied wholesale.

d) Desktop wallets / misc files
Paths harvested (wildcards resolved):
Exodus %AppData%\Exodus*.json / exodus.wallet
Ethereum %AppData%\Ethereum\keystore*
Electrum %AppData%\Electrum*\wallets*
Binance %AppData%\Binance\app-store.json
Desktop %UserProfile%\Desktop*.txt

5.3 Archiving & exfiltration • Uses WinInet (InternetOpenA / HttpOpenRequestA / HttpSendRequestA).
• Builds multipart/form-data:
Content-Type: multipart/form-data; boundary=91jkpa01sjqrty192
Form-field “fname”, filename “winrarupd.zip”.
• Sends to “http://evetesttech.net” – no encryption, no authentication.
• On HTTP 200 deletes the ZIP and calls _exit(0).

5.4 Persistence / lateral movement None. After execution artefacts are limited to: • Residual DLLs in %ProgramData% if cleanup fails.
• Any leftover files that could not be removed due to locks.
Therefore incident response must focus on data compromise, not system compromise.

6. Indicators of compromise (IOCs) 6.1 Files & paths
   C:\ProgramData\winrarupd.zip
   C:\ProgramData\sqlite3.dll, nss3.dll, freebl3.dll, softokn3.dll, mozglue.dll
   %ProgramData%\config.txt (key material)

6.2 Registry
None created.

6.3 Network
Domain : evetesttech.net
URI : “/” (root) via HTTP POST
Boundary : “91jkpa01sjqrty192”
User-Agent: inherited (not overridden) – often “Microsoft WinInet”.

6.4 YARA (minimal, case-insensitive)

rule InfoStealer_Winrarupd {
    strings:
        $url     = "http://evetesttech.net" nocase
        $zip     = "winrarupd.zip" nocase
        $bndry   = "91jkpa01sjqrty192"
        $sqlite  = "SELECT origin_url,username_value,password_value FROM `logins`"
    condition:
        2 of ($url,$zip,$bndry,$sqlite)
}

7. Detection & hunting tips • Look for outbound HTTP POSTs with multipart “fname=” and boundary above.
   • Detect creation of %ProgramData%\winrarupd.zip (Sysmon Event 11).
   • Monitor LoadLibrary calls for DLLs dropped into %ProgramData% by non-installer processes.
   • Watch for processes reading Chrome ›Local State‹ followed by DPAPI decryption routines.

8. Mitigation & remediation • Block evetesttech.net at DNS / firewall.
   • Reset browser-saved passwords, invalidate session cookies, enforce MFA.
   • Re-seed crypto-currency wallets: treat private keys as compromised.
   • Remove residual DLLs from %ProgramData%.
   • Full disk AV/EDR sweep – sample is un-packed, signatureable.
   • Reimage machines if sensitive corporate data was present in browsers/wallets.

9. Attribution / popularity Code structure resembles open-source “RedLine” forks, but strings and C2 are unique; no firm attribution.

──────────────────────────────────────────────────────────── Report prepared by: | Generated with static code-analysis & string inspection.
Let me know if deeper function flow graphs, runtime traces, or additional YARA/Suricata content are required._