Preliminary static triage of “05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1”

1. File facts
   • PE32 - console EXE, x86 (Machine 0x14c = 32-bit)
   • Image base 0x400000, entry-point 0x40AA68 → trampolines into the MSVC run-time.
   • Time/Date-stamp 0x630F722C (2022-08-31 14:27:24 UTC).
   • Not digitally signed.

2. Highlighted strings / IOCs
   • C2 domain: evetesttech[.]net (hard-coded).
   • HTTP template: “Content-Type: multipart/form-data; boundary=91jkpa01sjqrty192”.
   • Exfil file name on disk: c:\ProgramData\winrarupd.zip (created before upload).
   • Local staging files: c:\ProgramData\config.txt (temporary SQLite DB copy).
   • Large list of Chromium-based browser profile paths (Chrome, Edge, Brave, Opera, …).
   • SQLite query: SELECT origin_url, username_value, password_value FROM logins
   • Firefox artefacts: logins.json, cookies.sqlite, formhistory.sqlite + bundled NSS DLL paths.
   • 40+ browser-extension IDs for crypto-currency wallets (MetaMask, Ronin, Keplr, …).
   • Wallet application folders (Electrum, Exodus, Jaxx, Binance, etc.).

3. Key behaviour extracted from decompiled code

   FUN_00403D61 (≈ “steal_chrome_passwords”):
   • Copies the victim’s Login Data database into c:\ProgramData\config.txt.
   • Executes the query above and walks every row.
   • Decrypts Chrome passwords (custom routine calls FUN_00402722 / 00402842 – XOR/LFSR-like).
   • Builds plaintext lines: origin | user | pass → placed in a buffer.
   • On each successful decryption calls FUN_0040A474, which appends the line to an in-memory ZIP.
   • After iteration closes the DB and deletes c:\ProgramData\config.txt.

   Network exfiltration (FUN_0040A474):
   • Uses wininet.dll; builds a multipart/form-data POST to hxxp://evetesttech[.]net/winsock
   • Attaches “winrarupd.zip” (contains Passwords.txt, Cookies.txt, Autofills.txt, wallet files).

4. Capability overview
   • Collects and decrypts saved Chromium credentials.
   • Scrapes cookies, autofill entries, and multiple browser profile files.
   • Steals Firefox credentials by loading its NSS libraries dropped in c:\ProgramData.
   • Enumerates many crypto-wallet browser extensions and copies their LevelDB / Local Storage.
   • Searches desktop for *.txt “important files”.
   • Compresses everything into a ZIP archive and uploads to remote server.
   • Cleans up temporary artefacts afterwards.
   • Anti-analysis: calls IsDebuggerPresent; timestamp-based PRNG seed; light string obfuscation (custom xor).

5. Threat classification
   Behaviour strongly matches commodity information stealer families (RedLine / Vidar-like).
   Purpose: credential, cookie and crypto-wallet theft + exfiltration via clear-text HTTP.

6. Suggested next steps
   • Block / sinkhole evetesttech[.]net and any traffic to “/winsock”.
   • Hunt for creation or deletion of c:\ProgramData\config.txt and winrarupd.zip.
   • Monitor for loading of freebl3.dll, softokn3.dll, nss3.dll from ProgramData.
   • Sweep endpoints for the hash (SHA-256 = uploaded filename).
   • If executed, assume browser credentials & wallets are compromised; force password reset.
   • Submit the sample to a sandbox for full dynamic report if deeper behaviour is required.

Let me know if you’d like a deeper dive into any specific routine, dynamic-run report, or YARA/IOC package.*

# Malware Static-Analysis Report  
Sample: **05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1**  
Analyst: _\<your-name\>_  Date: _\<today\>_

---

## 1. Executive Summary
The specimen is a 32-bit Windows executable acting as an information stealer.  
It targets Chromium-based and Firefox browsers, crypto-wallet browser extensions, and several desktop / wallet files. Harvested data are compressed into a ZIP archive and exfiltrated to `evetesttech[.]net` over clear-text HTTP. Behaviour, artefacts and string set are characteristic of commodity stealers such as RedLine or Vidar.

---

## 2. File Metadata
| Property                    | Value |
|-----------------------------|-------|
| SHA-256                     | 05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1 |
| File type                   | PE32 executable (console) |
| Architecture                | Intel 80386 (32-bit) |
| ImageBase / Entry point     | 0x400000 / 0x0040AA68 |
| Timestamp (PE header)       | 2022-08-31 14:27:24 UTC |
| Compiler                    | MSVC 19 (linker 14.32 ⇒ VS 2022) |
| Digital signature           | none |
| Import hash (Imphash)       | _\<calculate if needed\>_ |

---

## 3. Static Analysis Findings

### 3.1 Interesting Strings

SELECT origin_url,username_value,password_value FROM logins \ProgramData\config.txt Content-Type: multipart/form-data; boundary=91jkpa01sjqrty192 http://evetesttech.net/winsock c:\ProgramData\winrarupd.zip

– Over 40 Chrome-extension IDs of popular crypto-wallets (MetaMask, TronLink, Ronin, Keplr, …)  
– Paths of multiple browsers (`%LOCALAPPDATA%\Google\Chrome\…`, Brave, Edge, Opera, Vivaldi, Kometa, …)  
– Wallet application directories (Exodus, Electrum, Jaxx, Binance, …)

### 3.2 Imports (subset)

kernel32!GetComputerNameA advapi32!GetUserNameA wininet!InternetOpenA / InternetConnectA / HttpOpenRequestA / HttpSendRequestA crypt32!CryptUnprotectData ; for Chrome DPAPI decryption fallback sqlite3!sqlite3_open / sqlite3_prepare (DLL path embedded) ; copied side-load

### 3.3 Key Routines  
(Addresses are RVA)

| Function        | Purpose |
|-----------------|---------|
| `0x00403D61`    | Copy Chrome “Login Data” DB → temp file, iterate rows, decrypt passwords, queue for exfiltration. |
| `0x0040A474`    | Build multipart/form-data POST, attach `winrarupd.zip`, send to C2 with WinINet APIs. |
| `0x00402842` + helpers | Custom XOR/LFSR routine used in password decryption / string obfuscation. |
| `0x00403C6D`    | DPAPI wrapper (`CryptUnprotectData`). |
| `0x004026E6`    | Simple IsDebuggerPresent & timing anti-analysis check. |

### 3.4 Artifacts Created / Deleted

c:\ProgramData\config.txt ; temporary SQLite copy c:\ProgramData\winrarupd.zip ; exfil bundle /lib/*.dll under ProgramData ; bundled NSS libraries for Firefox decryption

---

## 4. Behaviour Reconstruction (static-derived)

1. **Browser discovery**  
   Checks existence of hard-coded profile paths for Chrome, Edge, Brave, Opera, etc.

2. **Credential collection**  
   • Copies each “Login Data” SQLite DB to `config.txt`.  
   • Executes query for `origin_url, username_value, password_value`.  
   • For every row:  
     – If password begins with 0x01:03 (DPAPI blob) ⇒ decrypt via CryptUnprotectData.  
     – Else decrypt with internal XOR algorithm.  
   • Results stored as `origin | username | password` lines.

3. **Cookie / Autofill / Extension harvesting**  
   • Reads `Cookies`, `Web Data`, `Network\Cookies`, `autofill` tables.  
   • Copies LevelDB & Local Storage folders of 40+ wallet extensions.

4. **Firefox support**  
   • Drops `nss3.dll`, `softokn3.dll`, `freebl3.dll`, `mozglue.dll` into ProgramData.  
   • Loads them to call `PK11_GetInternalKeySlot` / decrypt logins.json entries.

5. **File grabbing**  
   • Wallet paths (`Electrum`, `Ethereum\keystore`, `Exodus`) and desktop `*.txt` files.

6. **Packaging & exfiltration**  
   • All loot is zipped (`winrarupd.zip`).  
   • HTTP POST to `http://evetesttech.net/winsock` with static boundary string.

7. **Cleanup**  
   • Deletes `config.txt` and possibly the DLLs/ZIP after successful upload.

---

## 5. Indicators of Compromise (IOC)

### 5.1 Network

http://evetesttech.net/winsock UA: "RT/1.0" Boundary: "91jkpa01sjqrty192"

### 5.2 Files / Paths

c:\ProgramData\config.txt c:\ProgramData\winrarupd.zip c:\ProgramData\freebl3.dll (and: softokn3.dll, nss3.dll, mozglue.dll) %LOCALAPPDATA%*\User Data*\Login Data (copied)

### 5.3 Registry / Process
No explicit persistence keys or scheduled tasks observed; sample is smash-and-grab.

---

## 6. Detection & Mitigation Guidance

1. **Network Filtering**  
   • Block / sinkhole `evetesttech[.]net` (any HTTP to `/winsock`).  
   • Alert on unusual HTTP multipart posts with boundary `91jkpa01sjqrty192`.

2. **Host-based Controls**  
   • Monitor for creation/deletion of `c:\ProgramData\config.txt` or `winrarupd.zip`.  
   • Detect DLL side-loading into ProgramData with names `nss3.dll`, `freebl3.dll`, etc.

3. **Threat Hunting**  
   • YARA rule targeting the long list of wallet extension IDs.  
   • Search EDR telemetry for processes reading Chrome/Edge “Login Data” then launching WinINet traffic to external hosts.

4. **Containment / Remediation**  
   • Force password change on any browser-stored credentials.  
   • Invalidate session cookies; encourage MFA.  
   • Advise users of potential crypto-wallet compromise; migrate funds.

---

## 7. Conclusion
The sample is a fully-featured infostealer focusing on web-credentials and crypto assets. It performs local decryption of protected data, packages results, and exfiltrates via clear-text HTTP. Rapid containment and credential hygiene are critical once execution is suspected.

---

*End of report*
```*