Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.vbs
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM "Discord.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "DiscordCanary.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "DiscordPTB.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "DiscordDevelopment.exe"
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\<File name>.exe
- %TEMP%\.exename
- %TEMP%\tmpbd071z41jor.vbs
- %TEMP%\content\5452-3268-cscript.exe-16-06-58-491.dump
- %LOCALAPPDATA%\exastealer\exastealer-obfuscated.jar
- %LOCALAPPDATA%\exastealer\jre.zip
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-console-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-console-l1-2-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-datetime-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-debug-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-errorhandling-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-fibers-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-fibers-l1-1-1.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-file-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-kernel32-legacy-l1-1-1.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-sysinfo-l1-2-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%\exastealer\bin\awt.dll
- %LOCALAPPDATA%\exastealer\bin\fontmanager.dll
- %LOCALAPPDATA%\exastealer\bin\freetype.dll
- %LOCALAPPDATA%\exastealer\bin\java.dll
- %LOCALAPPDATA%\exastealer\bin\java.exe
- %LOCALAPPDATA%\exastealer\bin\javajpeg.dll
- %LOCALAPPDATA%\exastealer\bin\javaw.exe
- %LOCALAPPDATA%\exastealer\bin\jawt.dll
- %LOCALAPPDATA%\exastealer\bin\jimage.dll
- %LOCALAPPDATA%\exastealer\bin\jli.dll
- %LOCALAPPDATA%\exastealer\bin\jsound.dll
- %LOCALAPPDATA%\exastealer\bin\keytool.exe
- %LOCALAPPDATA%\exastealer\bin\lcms.dll
- %LOCALAPPDATA%\exastealer\bin\mlib_image.dll
- %LOCALAPPDATA%\exastealer\bin\msvcp140.dll
- %LOCALAPPDATA%\exastealer\bin\net.dll
- %LOCALAPPDATA%\exastealer\bin\nio.dll
- %LOCALAPPDATA%\exastealer\bin\prefs.dll
- %LOCALAPPDATA%\exastealer\bin\splashscreen.dll
- %LOCALAPPDATA%\exastealer\bin\syslookup.dll
- %LOCALAPPDATA%\exastealer\bin\ucrtbase.dll
- %LOCALAPPDATA%\exastealer\bin\vcruntime140.dll
- %LOCALAPPDATA%\exastealer\bin\vcruntime140_1.dll
- %LOCALAPPDATA%\exastealer\bin\verify.dll
- %LOCALAPPDATA%\exastealer\bin\zip.dll
- %LOCALAPPDATA%\exastealer\bin\server\jvm.dll
- %LOCALAPPDATA%\exastealer\conf\jaxp.properties
- %LOCALAPPDATA%\exastealer\conf\logging.properties
- %LOCALAPPDATA%\exastealer\conf\net.properties
- %LOCALAPPDATA%\exastealer\conf\sound.properties
- %LOCALAPPDATA%\exastealer\conf\security\java.policy
- %LOCALAPPDATA%\exastealer\conf\security\java.security
- %LOCALAPPDATA%\exastealer\conf\security\policy\readme.txt
- %LOCALAPPDATA%\exastealer\conf\security\policy\limited\default_local.policy
- %LOCALAPPDATA%\exastealer\conf\security\policy\limited\default_us_export.policy
- %LOCALAPPDATA%\exastealer\conf\security\policy\limited\exempt_local.policy
- %LOCALAPPDATA%\exastealer\conf\security\policy\unlimited\default_local.policy
- %LOCALAPPDATA%\exastealer\conf\security\policy\unlimited\default_us_export.policy
- %LOCALAPPDATA%\exastealer\include\classfile_constants.h
- %LOCALAPPDATA%\exastealer\include\jawt.h
- %LOCALAPPDATA%\exastealer\include\jni.h
- %LOCALAPPDATA%\exastealer\include\jvmti.h
- %LOCALAPPDATA%\exastealer\include\jvmticmlr.h
- %LOCALAPPDATA%\exastealer\include\win32\jawt_md.h
- %LOCALAPPDATA%\exastealer\include\win32\jni_md.h
- %LOCALAPPDATA%\exastealer\legal\java.base\aes.md
- %LOCALAPPDATA%\exastealer\legal\java.base\asm.md
- %LOCALAPPDATA%\exastealer\legal\java.base\c-libutl.md
- %LOCALAPPDATA%\exastealer\legal\java.base\cldr.md
- %LOCALAPPDATA%\exastealer\legal\java.base\copyright
- %LOCALAPPDATA%\exastealer\legal\java.base\icu.md
- %LOCALAPPDATA%\exastealer\legal\java.base\license
- %LOCALAPPDATA%\exastealer\legal\java.base\public_suffix.md
- %LOCALAPPDATA%\exastealer\legal\java.base\siphash.md
- %LOCALAPPDATA%\exastealer\legal\java.base\unicode.md
- %LOCALAPPDATA%\exastealer\legal\java.base\wepoll.md
- %LOCALAPPDATA%\exastealer\legal\java.base\zlib.md
- %LOCALAPPDATA%\exastealer\legal\java.datatransfer\copyright
- %LOCALAPPDATA%\exastealer\legal\java.datatransfer\license
- %LOCALAPPDATA%\exastealer\legal\java.desktop\colorimaging.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\copyright
- %LOCALAPPDATA%\exastealer\legal\java.desktop\freetype.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\giflib.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\harfbuzz.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\jpeg.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\lcms.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\libpng.md
- %LOCALAPPDATA%\exastealer\legal\java.desktop\license
- %LOCALAPPDATA%\exastealer\legal\java.desktop\mesa3d.md
- %LOCALAPPDATA%\exastealer\legal\java.logging\copyright
- %LOCALAPPDATA%\exastealer\legal\java.logging\license
- %LOCALAPPDATA%\exastealer\legal\java.prefs\copyright
- %LOCALAPPDATA%\exastealer\legal\java.prefs\license
- %LOCALAPPDATA%\exastealer\legal\java.xml\bcel.md
- %LOCALAPPDATA%\exastealer\legal\java.xml\copyright
- %LOCALAPPDATA%\exastealer\legal\java.xml\dom.md
- %LOCALAPPDATA%\exastealer\legal\java.xml\jcup.md
- %LOCALAPPDATA%\exastealer\legal\java.xml\license
- %LOCALAPPDATA%\exastealer\legal\java.xml\xalan.md
- %LOCALAPPDATA%\exastealer\legal\java.xml\xerces.md
- %LOCALAPPDATA%\exastealer\lib\classlist
- %LOCALAPPDATA%\exastealer\lib\fontconfig.bfc
- %LOCALAPPDATA%\exastealer\lib\fontconfig.properties.src
- %LOCALAPPDATA%\exastealer\lib\jawt.lib
- %LOCALAPPDATA%\exastealer\lib\jrt-fs.jar
- %LOCALAPPDATA%\exastealer\lib\jvm.cfg
- %LOCALAPPDATA%\exastealer\lib\jvm.lib
- %LOCALAPPDATA%\exastealer\lib\modules
- %LOCALAPPDATA%\exastealer\lib\psfont.properties.ja
- %LOCALAPPDATA%\exastealer\lib\psfontj2d.properties
- %LOCALAPPDATA%\exastealer\lib\tzdb.dat
- %LOCALAPPDATA%\exastealer\lib\tzmappings
- %LOCALAPPDATA%\exastealer\lib\security\blocked.certs
- %LOCALAPPDATA%\exastealer\lib\security\cacerts
- %LOCALAPPDATA%\exastealer\lib\security\default.policy
- %LOCALAPPDATA%\exastealer\lib\security\public_suffix_list.dat
- %LOCALAPPDATA%\exastealer\release
- %LOCALAPPDATA%\exastealer\.jar_ready
- nul
- %TEMP%\hsperfdata_user\5748
- %TEMP%\debug.log
- %LOCALAPPDATA%\localstate\425acda8\sys_cache_03833c86.dll
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-4226853953-3309226944-3078887307-1000\83aa4cc77f591dfc2374580bbd95f6ba_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %TEMP%\jna-3599307\jna17297419998833928636.dll
- %TEMP%\capture.png
- %TEMP%\1781219245858-data_exa-83377a5bf94e.zip
- %TEMP%\exastealer_libs\sqlite3.dll
- %TEMP%\db_14068662933344250586_cookies.sqlite
- %TEMP%\db_3270251409000083067_cookies.sqlite
- %TEMP%\db_736836820940632280_cookies.sqlite
- %TEMP%\db_8816577873652473018_cookies.sqlite
- %TEMP%\db_3270251409000083067_cookies.sqlite-shm
- %TEMP%\db_14068662933344250586_cookies.sqlite-shm
- %TEMP%\db_8816577873652473018_cookies.sqlite-shm
- %TEMP%\db_736836820940632280_cookies.sqlite-shm
- %TEMP%\db_15958551339183631675_login data
- %TEMP%\db_11603566484553195641_places.sqlite
- %TEMP%\db_834583072543581605_places.sqlite
- %TEMP%\db_17225240480981228487_places.sqlite
- %TEMP%\db_12601445716243566046_places.sqlite
- %TEMP%\db_3026048543083761045_web data
- %TEMP%\db_13806440544154118704_web data
- %TEMP%\db_1708015125134083605_history
- %TEMP%\db_834583072543581605_places.sqlite-shm
- %TEMP%\db_12601445716243566046_places.sqlite-shm
- %TEMP%\db_17225240480981228487_places.sqlite-shm
- %TEMP%\db_11603566484553195641_places.sqlite-shm
Deletes following files that it created itself
- %LOCALAPPDATA%\exastealer\jre.zip
- %TEMP%\jna-3599307\jna17297419998833928636.dll
- %TEMP%\capture.png
- %TEMP%\db_8816577873652473018_cookies.sqlite-shm
- %TEMP%\db_8816577873652473018_cookies.sqlite
- %TEMP%\db_3270251409000083067_cookies.sqlite-shm
- %TEMP%\db_14068662933344250586_cookies.sqlite-shm
- %TEMP%\db_3270251409000083067_cookies.sqlite
- %TEMP%\db_14068662933344250586_cookies.sqlite
- %TEMP%\db_736836820940632280_cookies.sqlite-shm
- %TEMP%\db_736836820940632280_cookies.sqlite
- %TEMP%\db_15958551339183631675_login data
- %TEMP%\db_3026048543083761045_web data
- %TEMP%\db_13806440544154118704_web data
- %TEMP%\db_1708015125134083605_history
- %TEMP%\db_834583072543581605_places.sqlite-shm
- %TEMP%\db_834583072543581605_places.sqlite
- %TEMP%\db_17225240480981228487_places.sqlite-shm
- %TEMP%\db_17225240480981228487_places.sqlite
- %TEMP%\db_12601445716243566046_places.sqlite-shm
- %TEMP%\db_12601445716243566046_places.sqlite
- %TEMP%\db_11603566484553195641_places.sqlite-shm
- %TEMP%\db_11603566484553195641_places.sqlite
Network activity
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ic###azip.com
- DNS ASK ch#####.amazonaws.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\tmpbd071z41jor.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Expand-Archive -Path '%LOCALAPPDATA%\Exastealer\jre.zip' -DestinationPath '%LOCALAPPDATA%\Exastealer' -Force"
- '%LOCALAPPDATA%\exastealer\bin\java.exe' -noverify -jar %LOCALAPPDATA%\Exastealer\exastealer-obfuscated.jar
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /s /c "powershell -NoProfile -Command "Expand-Archive -Path '%LOCALAPPDATA%\Exastealer\jre.zip' -DestinationPath '%LOCALAPPDATA%\Exastealer' -Force""
- '<SYSTEM32>\cscript.exe' //nologo %TEMP%\tmpbd071z41jor.vbs' (with hidden window)
- '<Full path to file>' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /s /c "powershell -NoProfile -Command "Expand-Archive -Path '%LOCALAPPDATA%\Exastealer\jre.zip' -DestinationPath '%LOCALAPPDATA%\Exastealer' -Force""' (with hidden window)
- '%LOCALAPPDATA%\exastealer\bin\java.exe' -noverify -jar %LOCALAPPDATA%\Exastealer\exastealer-obfuscated.jar' (with hidden window)