Hostile ^92% windows Download

Loader.exe

Browser credential stealer with anti-debug

TLS loader with paired anti-debug checks, IPC, and cleanupPaired debugger-check API strings

SHA-2565c8e45cbc43e5e7b15d41c0e4bf245e9b904b4d316db90448ecf10e6eb080ece

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Li)O₂(AlCa₂)H₁₀(Cm₅Cr₃Db₃DsF₈Hf₄MgOs₁₀Po₇Ti)Md₃(Bi₄BkPa)

Evidence

TLS loader with paired anti-debug checks, IPC, and cleanup 0x0–0x110

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows

Dense x64 TLS-array pointer access 0x8540–0x8600

⋯3 more rows
0x85709df8090000e9c2f4ffff8b0524683900............$h9.
0x858065488b0c2558000000488b04c1488d80eH..%X...H...H..
0x8590c8000000488985f807000083bde80900....H...........
⋯7 more rows

DPAPI credential decryption 0x2a911f–0x2a917f

0x2a911f30392e3056395f30556e61737369676e09.0V9_0Unassign
0x2a912f6564756e61737369676e656476313030edunassignedv100
0x2a913f76313176313130763132307631323176v11v110v120v121v
0x2a914f31333076313430763135307631353176130v140v150v151v
⋯3 more rows

Chromium app-bound key name 0x2ffef8–0x3001e8

⋯3 more rows
0x2fff28494c45476f6f676c65204368726f6d65ILEGoogle Chrome
0x2fff386368726f6d652e657865476f6f676c65chrome.exeGoogle
0x2fff485c4368726f6d655c5573657220446174\Chrome\User Dat
0x2fff58615c4c6f63616c205374617465476f6fa\Local StateGoo
0x2fff68676c65204368726f6d656b6579314272gle Chromekey1Br
0x2fff786176654272617665536f667477617265aveBraveSoftware
0x2fff885c42726176652d42726f777365725c55\Brave-Browser\U
0x2fff98736572204461746162726176652e6578ser Databrave.ex
0x2fffa8654272617665536f6674776172655c42eBraveSoftware\B
⋯3 more rows
0x2fffe86b6579314d6963726f736f6674204564key1Microsoft Ed
0x2ffff867656d73656467652e6578654d696372gemsedge.exeMicr
0x3000086f736f66745c456467655c5573657220osoft\Edge\User 
0x300018446174615c4c6f63616c205374617465Data\Local State
0x3000284d6963726f736f667420456467656b65Microsoft Edgeke
0x30003879314f706572614f7065726120536f66y1OperaOpera Sof
0x30004874776172655c4f706572612053746162tware\Opera Stab
0x3000586c656f706572612e6578654f70657261leopera.exeOpera
0x30006820536f6674776172655c4f7065726120 Software\Opera 
0x300078537461626c655c4c6f63616c20537461Stable\Local Sta
0x30008874654f7065726120536f667477617265teOpera Software
⋯4 more rows
0x3000d85820537461626c655c4c6f63616c2053X Stable\Local S
0x3000e87461746559616e6465782042726f7773tateYandex Brows
0x3000f8657259616e6465785c59616e64657842erYandex\YandexB
0x300108726f777365725c557365722044617461rowser\User Data
0x30011862726f777365722e65786559616e6465browser.exeYande
0x300128785c59616e64657842726f777365725cx\YandexBrowser\
0x3001385573657220446174615c4c6f63616c20User Data\Local 
0x300148537461746559616e6465786b65793156StateYandexkey1V
0x3001586976616c6469566976616c64695c5573ivaldiVivaldi\Us
0x30016865722044617461766976616c64692e65er Datavivaldi.e
0x3001787865566976616c64695c557365722044xeVivaldi\User D
0x3001886174615c4c6f63616c20537461746556ata\Local StateV
0x3001986976616c64696b6579314368726f6d69ivaldikey1Chromi
0x3001a8756d4368726f6d69756d5c5573657220umChromium\User 
0x3001b8446174616368726f6d69756d2e657865Datachromium.exe
0x3001c84368726f6d69756d5c55736572204461Chromium\User Da
0x3001d874615c4c6f63616c2053746174654368ta\Local StateCh
0x3001e8726f6d69756d6b65793143656e744272romiumkey1CentBr

Paired debugger-check API strings 0x399104–0x399244

⋯5 more rows
0x3991546e64566f6c756d65436c6f736500b003ndVolumeClose...
0x3991644973446562756767657250726573656eIsDebuggerPresen
0x39917474009700436865636b52656d6f746544t...CheckRemoteD
0x3991846562756767657250726573656e740000ebuggerPresent..
0x3991945a05536574456e7669726f6e6d656e74Z.SetEnvironment
⋯11 more rows