1<!doctype html><html lang=en><head><meta name=generator content="Hugo 0.165.0"><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=robots content="noodp"><title>d01a</title><meta name=Description content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&TH"><meta property="og:url" content="https://d01a.github.io/"><meta property="og:site_name" content="d01a"><meta property="og:title" content="d01a"><meta property="og:description" content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&TH"><meta property="og:locale" content="en"><meta property="og:type" content="website"><meta property="og:image" content="https://d01a.github.io/assets/image/avatar.png"><meta name=twitter:card content="summary_large_image"><meta name=twitter:image content="https://d01a.github.io/assets/image/avatar.png"><meta name=twitter:title content="d01a"><meta name=twitter:description content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&TH"><meta name=application-name content="d01a"><meta name=apple-mobile-web-app-title content="d01a"><meta name=referrer content="no-referrer"><meta name=theme-color content="#ffffff"><meta name=msapplication-TileColor content="#da532c"><link rel=icon href=./images/Luffy.svg><link rel=apple-touch-icon sizes=180x180 href=/apple-touch-icon.png><link rel=mask-icon href=/safari-pinned-tab.svg color=#5bbad5><link rel=manifest href=/site.webmanifest><link rel=canonical href=https://d01a.github.io/><link rel=alternate href=/index.xml type=application/rss+xml title=d01a><link rel=feed href=/index.xml type=application/rss+xml title=d01a><link rel=stylesheet href=/css/style.min.css><link rel=preload href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css></noscript><link rel=preload href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css></noscript>
1<script type=application/ld+json>{"@context":"http://schema.org","@type":"WebSite","url":"https:\/\/d01a.github.io\/","inLanguage":"en","author":{"@type":"Person","name":"Mohamed Adel"},"description":"This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE\u0026TH","name":"d01a"}</script>
1</head><body data-header-desktop=fixed data-header-mobile=auto>
1<script>const query=window.matchMedia("(prefers-color-scheme: dark)");function applyTheme(){let e=window.localStorage?.getItem("theme")||"auto",t=e==="dark"||e==="auto"&&query.matches;document.body.setAttribute("theme",t?"dark":"light"),document.body.setAttribute("cfg-theme",e)}applyTheme(),query.addEventListener("change",applyTheme)</script>
1<div id=mask></div><div class=wrapper><header class=desktop id=header-desktop><div class=header-wrapper><div class=header-title><a href=/ title=d01a><span class=header-title-pre><i class='fa-solid fa-terminal' aria-hidden=true></i></span>d01a</a></div><div class=menu><div class=menu-inner><a class=menu-item href=/posts/ title=Posts>Posts </a><a class=menu-item href=/tags/ title=Tags>Tags </a><a class=menu-item href=/categories/ title=Categories>Categories </a><a class=menu-item href=/about/>About </a><a class=menu-item href=https://github.com/d01a title=GitHub rel="noopener noreffer" target=_blank><i class='fab fa-github fa-fw' aria-hidden=true></i> </a><span class="menu-item delimiter"></span><span class="menu-item search" id=search-desktop> 2<input type=text placeholder="Search titles or contents..." id=search-input-desktop> 3<a href=javascript:void(0); class="search-button search-toggle" id=search-toggle-desktop title=Search><i class="fas fa-search" aria-hidden=true></i> 4</a><a href=javascript:void(0); class="search-button search-clear" id=search-clear-desktop title=Clear><i class="fas fa-times-circle" aria-hidden=true></i> 5</a><span class="search-button search-loading" id=search-loading-desktop><i class="fas fa-spinner fa-spin" aria-hidden=true></i> 6</span></span><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme"><i class="fas fa-adjust" aria-hidden=true></i></a></div></div></div></header><header class=mobile id=header-mobile><div class=header-container><div class=header-wrapper><div class=header-title><a href=/ title=d01a><span class=header-title-pre><i class='fa-solid fa-terminal' aria-hidden=true></i></span>d01a</a></div><div class=menu-toggle id=menu-toggle-mobile><span></span><span></span><span></span></div></div><div class=menu id=menu-mobile><div class=search-wrapper><div class="search mobile" id=search-mobile><input type=text placeholder="Search titles or contents..." id=search-input-mobile> 7<a href=javascript:void(0); class="search-button search-toggle" id=search-toggle-mobile title=Search><i class="fas fa-search" aria-hidden=true></i> 8</a><a href=javascript:void(0); class="search-button search-clear" id=search-clear-mobile title=Clear><i class="fas fa-times-circle" aria-hidden=true></i> 9</a><span class="search-button search-loading" id=search-loading-mobile><i class="fas fa-spinner fa-spin" aria-hidden=true></i></span></div><a href=javascript:void(0); class=search-cancel id=search-cancel-mobile>Cancel</a></div><a class=menu-item href=/posts/ title=Posts>Posts</a><a class=menu-item href=/tags/ title=Tags>Tags</a><a class=menu-item href=/categories/ title=Categories>Categories</a><a class=menu-item href=/about/ title>About</a><a class=menu-item href=https://github.com/d01a title=GitHub rel="noopener noreffer" target=_blank><i class='fab fa-github fa-fw' aria-hidden=true></i></a><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme"> 10<i class="fas fa-adjust" aria-hidden=true></i></a></div></div></header><div class="search-dropdown desktop"><div id=search-dropdown-desktop></div></div><div class="search-dropdown mobile"><div id=search-dropdown-mobile></div></div><main class=main><div class=container><div class="page home" data-home=posts><div class=home-profile><div class=home-avatar><a href=/posts/ title=Posts><img class=lazyload src=/svg/loading.min.svg data-src=/images/avatar.png data-srcset="/images/avatar.png, /images/avatar.png 1.5x, /images/avatar.png 2x" data-sizes=auto alt=/images/avatar.png title=/images/avatar.png width=715 height=715></a></div><h1 class=home-title>d01a</h1><div class=home-subtitle><div id=id-1 class=typeit></div></div><div class=links><a href=https://github.com/d01a title=GitHub target=_blank rel="noopener noreffer me"><i class="fab fa-github" aria-hidden=true></i></a><a href=https://linkedin.com/in/mohamedadel46 title=LinkedIn target=_blank rel="noopener noreffer me"><i class="fab fa-linkedin" aria-hidden=true></i></a><a href=https://x.com/0xd01a title=X target=_blank rel="noopener noreffer me"><i class="fab fa-x-twitter" aria-hidden=true></i></a><a href=https://discordapp.com/users/0xd01a title=Discord target=_blank rel="noopener noreffer me"><i class="fab fa-discord" aria-hidden=true></i></a><a href=/index.xml title=RSS target=_blank rel="noopener noreffer me"><i class="fas fa-rss" aria-hidden=true></i></a></div></div><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/xloader/><img class=lazyload src=/svg/loading.min.svg data-src=/xloader/featured-image.png data-srcset="/xloader/featured-image.png, /xloader/featured-image.png 1.5x, /xloader/featured-image.png 2x" data-sizes=auto alt=/xloader/featured-image.png title="Generic campaigns that use a combination of JScript, PowerShell, and .Net to load a final payload; Xloader in this case"></a></div><h1 class=single-title itemprop="name headline"><a href=/xloader/>The road to Xloader</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2026-09-05>2026-09-05</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>Xloader is a stealer that was built on the FormBook malware family that first emerged in 2016; the rebranded Xloader was introduced in 2020. It is highly sophisticated malware that uses a combination of anti-analysis and obfuscation techniques, and it’s written in pure assembly, so there are minimal compiler artifacts.</p><p>The infection chain used in this campaign is widely used to deliver multiple different mal
10ware families in a very similar way, with almost identical loader characteristics.</p></div><div class=post-footer><a href=/xloader/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/alphv/><img class=lazyload src=/svg/loading.min.svg data-src=/alphv/featured-image.jpg data-srcset="/alphv/featured-image.jpg, /alphv/featured-image.jpg 1.5x, /alphv/featured-image.jpg 2x" data-sizes=auto alt=/alphv/featured-image.jpg title="ALPHV ransomware analysis"></a></div><h1 class=single-title itemprop="name headline"><a href=/alphv/>ALPHV ransomware</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2024-05-30>2024-05-30</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>ALPHV/Blackcat is a ransomware family that uses Ransomware-as-a-service (RaaS) business model. The ransomware is written in Rust Programming language. It is highly configurable using embedded configurations or provided as command line arguments. The malware family has Windows, Linux and ESXi versions. The malware uses AES or ChaCha20 to encrypt the files and delete the volume shadow copies to decrease the possibility of any data survival. It also kills predefined set of services and Processes related to Anti-malware products, Virtualization software and other business-related and backup software. The following graph represents the attack flow of the ransomware.</p></div><div class=post-footer><a href=/alphv/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/redline/><img class=lazyload src=/svg/loading.min.svg data-src=/redline/featured-image.jpg data-srcset="/redline/featured-image.jpg, /redline/featured-image.jpg 1.5x, /redline/featured-image.jpg 2x" data-sizes=auto alt=/redline/featured-image.jpg title="Redline stealer analysis"></a></div><h1 class=single-title itemprop="name headline"><a href=/redline/>Redline stealer</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2024-05-30>2024-05-30</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>Redline stealer is one of the most popular info stealers out there. The malware is available for sale on underground forums for a different subscription options. The malware has a large set of stealing modules. It harvests:</p><ul><li>Victim information (such as hostname, hardware specs, location, and live screenshot)</li><li>Browser data (such as saved passwords, cookies, and autofill fields)</li><li>Crypto wallets</li><li>Telegram data</li><li>Discord tokens</li><li>Specific files from the victim machine</li><li>FTP server credentials</li><li>Game launcher data (Steam login files)</li><li>VPN credentials</li></ul><p>Also, it has a component that can be used as a loader to execute other malware families or download a newer version of the stealer.</p></div><div class=post-footer><a href=/redline/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/syscalls/><img class=lazyload src=/svg/loading.min.svg data-src=/syscalls/featured-image.jpg data-srcset="/syscalls/featured-image.jpg, /syscalls/featured-image.jpg 1.5x, /syscalls/featured-image.jpg 2x" data-sizes=auto alt=/syscalls/featured-image.jpg title="Exploring the Concepts of Direct and Indirect Syscalls, and Reverse Engineering Syscalls implementation in Cobalt Strike"></a></div><h1 class=single-title itemprop="name headline"><a href=/syscalls/>Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2023-08-18>2023-08-18</time></span> <span class=post-category>included in <a href=/categories/reverse-engineering/><i class="far fa-folder" aria-hidden=true></i>Reverse Engineering</a> <a href=/categories/research/><i class="far fa-folder" aria-hidden=true></i>Research</a></span></div><div class=content><h2 id=syscalls-why>Syscalls? Why?</h2><ul><li>To Bypass user-mood hooks. why?<ul><li>For Hiding a code inside a legitimate process (Process Injection)</li><li>Avoiding EDR alerts!</li></ul></li></ul><h3 id=user-mood-hooks>User-mood Hooks</h3><p>Hooking user-mode functions by placing a jump to another code section. EDRs use hooks to check the function parameters. For example, if you are trying to change the memory protections of some data to add executable protections. This is a very suspicious activity so EDRs will be alert to that. Most Hooks are on the lowest level of the user-mode interface in <strong>ntdll.dll</strong> which are the system calls.</p></div><div class=post-footer><a href=/syscalls/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a>, <a href=/tags/research/>Research</a>, <a href=/tags/post-exploitation/>Post-Exploitation</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/pikabot/><img class=lazyload src=/svg/loading.min.svg data-src=/pikabot/featured-image.jpg data-srcset="/pikabot/featured-image.jpg, /pikabot/featured-image.jpg 1.5x, /pikabot/featured-image.jpg 2x" data-sizes=auto alt=/pikabot/featured-image.jpg title="Pikabot loader and core deep analysis"></a></div><h1 class=single-title itemprop="name headline"><a href=/pikabot/>Pikabot deep analysis</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2023-07-31>2023-07-31</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>Pikabot is a new malware first seen in early 2023. It has two components: Loader and core module. It is still in its initial stages, expected to see increasing activity in the future. 11Some researchers believe that it is linked to TA570 because of the similarity of delivering method between it and <code>Qbot</code> trojan. And the absence of <code>Qbot</code>
11 activity in the period of <code>pikabot</code> activity. 12The Loader usage is to perform a lot of Anti-debug, Anti-VM and Anti-emulation checks to make it harder for automated analysis and inject the core module. 13The strings are obfuscated using the stack and simple Bitwise operation. The constant integers are obfuscated using structures and loops to get the right offset. 14The core module has a lot of functionality that gives the attacker full control of the victim machine.</p></div><div class=post-footer><a href=/pikabot/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/aurora-stealer-builder/><img class=lazyload src=/svg/loading.min.svg data-src=/aurora-stealer-builder/featured-image.jpg data-srcset="/aurora-stealer-builder/featured-image.jpg, /aurora-stealer-builder/featured-image.jpg 1.5x, /aurora-stealer-builder/featured-image.jpg 2x" data-sizes=auto alt=/aurora-stealer-builder/featured-image.jpg title="Aurora Stealer Builder"></a></div><h1 class=single-title itemprop="name headline"><a href=/aurora-stealer-builder/>Aurora Stealer Builder</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2023-04-23>2023-04-23</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>in the previous article, I discussed whatâs inside Aurora Stealer. After the release, <a href=https://twitter.com/gi7w0rm target=_blank rel="noopener noreffer">@Gi7w0rm</a> provided me samples of some versions of Aurora Stealer builder, a new version that was created recently and another one that was created in 2022. The newer version has some improvements in the builder and new features we will discuss in this article. Before we start this article, it is important to note that the Builder also contains and creates the Web panel to control the bots. This means the binaries we are looking at are actually a hybrid between a builder and a panel.</p></div><div class=post-footer><a href=/aurora-stealer-builder/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/aurora-stealer/><img class=lazyload src=/svg/loading.min.svg data-src=/aurora-stealer/featured-image.jpg data-srcset="/aurora-stealer/featured-image.jpg, /aurora-stealer/featured-image.jpg 1.5x, /aurora-stealer/featured-image.jpg 2x" data-sizes=auto alt=/aurora-stealer/featured-image.jpg title="Aurora Stealer"></a></div><h1 class=single-title itemprop="name headline"><a href=/aurora-stealer/>Aurora Stealer</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2023-04-12>2023-04-12</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=introduction>Introduction</h2><p>Aurora Stealer is an information stealer Written in GO. It is a commercial stealer that costs around 250$ per month. The malware can steal Browser password and saved cookies, crypto information (Desktop and Web), Telegram, Steam and Specific files from the victim machine and can take a screenshot from it.</p><p><img class=lazyload src=/svg/loading.min.svg data-src=/aurora-stealer/Aurora%20Stealer%203ac5d7639dee4d95b3cfd546053de596/Untitled.png data-srcset="/aurora-stealer/Aurora%20Stealer%203ac5d7639dee4d95b3cfd546053de596/Untitled.png, /aurora-stealer/Aurora%20Stealer%203ac5d7639dee4d95b3cfd546053de596/Untitled.png 1.5x, /aurora-stealer/Aurora%20Stealer%203ac5d7639dee4d95b3cfd546053de596/Untitled.png 2x" data-sizes=auto alt=/aurora-stealer/Aurora%20Stealer%203ac5d7639dee4d95b3cfd546053de596/Untitled.png title=Untitled width=680 height=591></p><h2 id=basic-information>Basic information</h2><p>The icon of the executable gives us a hit about how this is spreading. It has Photoshop icon, most probably it was spreading using Malvertising.</p></div><div class=post-footer><a href=/aurora-stealer/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/originlogger/><img class=lazyload src=/svg/loading.min.svg data-src=/originlogger/featured-image.png data-srcset="/originlogger/featured-image.png, /originlogger/featured-image.png 1.5x, /originlogger/featured-image.png 2x" data-sizes=auto alt=/originlogger/featured-image.png title="OriginLogger: A look at OriginLogger Loader, extracting the final payload and network traffic analysis"></a></div><h1 class=single-title itemprop="name headline"><a href=/originlogger/>OriginLogger Loader</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2023-01-16>2023-01-16</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=conclusion>Conclusion</h2><p>Origin Logger is a variant of Agent tesla, it is build on top of it and uses all of its capabilities. The malware is spreading using spam emails with a malicious attachments. The malware exfiltrate user accounts and passwords and other information from the infected machine.</p><h2 id=infection-through-email>Infection through Email</h2><p>the infection is started with spam email attached by <code>.iso</code> File</p><p><img class=lazyload src=/svg/loading.min.svg data-src=/originlogger/img/email.png data-srcset="/originlogger/img/email.png, /originlogger/img/email.png 1.5x, /originlogger/img/email.png 2x" data-sizes=auto alt=/originlogger/img/email.png title=/
14originlogger/img/email.png width=1388 height=557></p></div><div class=post-footer><a href=/originlogger/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article><article class="single summary" itemscope itemtype=http://schema.org/Article><div class=featured-image-preview><a href=/raccoon-stealer/><img class=lazyload src=/svg/loading.min.svg data-src=/raccoon-stealer/featured-image.jpg data-srcset="/raccoon-stealer/featured-image.jpg, /raccoon-stealer/featured-image.jpg 1.5x, /raccoon-stealer/featured-image.jpg 2x" data-sizes=auto alt=/raccoon-stealer/featured-image.jpg title="Raccoon Stealer"></a></div><h1 class=single-title itemprop="name headline"><a href=/raccoon-stealer/>Raccoon Stealer</a></h1><div class=post-meta><span class=post-author><a href=https://d01a.github.io title=Author target=_blank rel="noopener noreffer author" class=author><i class="fas fa-user-circle" aria-hidden=true></i>Mohamed Adel</a></span> <span class=post-publish>published on <time datetime=2022-09-12>2022-09-12</time></span> <span class=post-category>included in <a href=/categories/malware-analysis/><i class="far fa-folder" aria-hidden=true></i>Malware Analysis</a></span></div><div class=content><h2 id=conclusion>Conclusion</h2><p>Raccoon Stealer V2 (or RecordBreaker) Is a stealer that provided as a service with about 200$/m. It is a new version of Raccoon stealer that appeared in 2019 and died for a while then it returns with this new Stealer which known as RecordBreaker.<br>It Comes with a lot of capabilities, It can grab a lot of sensitive information like :</p><ol><li>Steal Victim System information</li><li>Steal Victim Username and passwords stored in the browser</li><li>Steal Victim Browser’s Autofill Information</li><li>Steal Credit Card information</li><li>Steal Crypto wallets Information</li><li>Steal Bitcoin Wallets</li><li>Grab any file from the victim system</li><li>Take Screenshots from the victim system</li><li>Load next stage</li></ol><h2 id=analysis>Analysis</h2><h3 id=first-look>First Look</h3><p>First we start with basic analysis, using Detect it easy we see that the file seems to be not packed. Exploring the strings tab, we see a lot of base64 encoded strings and two registry keys <code>SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</code> and <code>SOFTWARE\Microsoft\Cryptography</code></p></div><div class=post-footer><a href=/raccoon-stealer/>Read More</a><div class=post-tags><i class="fas fa-tags" aria-hidden=true></i> <a href=/tags/malware-analysis/>Malware Analysis</a>, <a href=/tags/reverse-engineering/>Reverse Engineering</a></div></div></article></div></div></main><footer class=footer><div class=footer-container><div class=footer-line>Powered by <a href=https://gohugo.io/ target=_blank rel="noopener noreffer" title="Hugo 0.165.0">Hugo</a> | Theme - <a href=https://github.com/dillonzq/LoveIt target=_blank rel="noopener noreffer" title="LoveIt 1.0.0"><i class="far fa-kiss-wink-heart" aria-hidden=true></i> LoveIt</a></div><div class=footer-line itemscope itemtype=http://schema.org/CreativeWork><i class="far fa-copyright" aria-hidden=true></i><span itemprop=copyrightYear>2022 - 2026</span><span class=author itemprop=copyrightHolder> <a href=https://www.linkedin.com/in/mohamedadel46/ target=_blank>Mohamed Adel</a></span> | <span class=license><a rel="license external nofollow noopener noreffer" href=https://creativecommons.org/licenses/by-nc/4.0/ target=_blank>CC BY-NC 4.0</a></span></div></div></footer></div><div id=fixed-buttons><a href=# id=back-to-top class=fixed-button title="Back to Top"><i class="fas fa-arrow-up" aria-hidden=true></i></a></div><div id=fixed-buttons-hidden><a href=# id=view-comments class=fixed-button title="View Comments"><i class="fas fa-comment" aria-hidden=true></i></a></div><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/autocomplete.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/lunr.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/lazysizes.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/clipboard.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/sharer.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/index.umd.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/auto-render.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/copy-tex.min.js></script>
14<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/mhchem.min.js></script>
14<script>window.config={data:{"id-1":"All about Malware Analysis, Reverse engineering, CTI and DE&TH"},math:{delimiters:[{display:!0,left:"$$",right:"$$"},{display:!0,left:"\\[",right:"\\]"},{display:!0,left:"\\begin{equation}",right:"\\end{equation}"},{display:!0,left:"\\begin{equation*}",right:"\\end{equation*}"},{display:!0,left:"\\begin{align}",right:"\\end{align}"},{display:!0,left:"\\begin{align*}",right:"\\end{align*}"},{display:!0,left:"\\begin{alignat}",right:"\\end{alignat}"},{display:!0,left:"\\begin{alignat*}",right:"\\end{alignat*}"},{display:!0,left:"\\begin{gather}",right:"\\end{gather}"},{display:!0,left:"\\begin{CD}",right:"\\end{CD}"},{display:!1,left:"$",right:"$"},{display:!1,left:"\\(",right:"\\)"}],strict:!1},search:{highlightTag:"em",lunrIndexURL:"/index.json",maxResultLength:10,noResultsFound:"No results found",snippetLength:30,type:"lunr"},typeit:{cursorChar:"|",cursorSpeed:1e3,data:{"id-1":["id-1"]},duration:-1,speed:100}}</script>
14<script src=/js/theme.js></script>
14</body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.