Analysis of .Net Stealer GrandSteal (2019–03–18)

In this post I share my notes about the analysis of a sample (an stealer written in .Net) whose family is unknown to me (any feedback is welcome, if you know the family for the sample that I describe, please tell me and I will update this post). Somebody tagged the sample as quasar at Any.Run, however, after analyzing it and comparing with Quasar code, I concluded this sample doesn’t seem to belong to Quasar family. Searching information about the collected IoCs was not successful to classify the sample. I am calling it GrandSteal because of the internal names of the .Net classes of the malware’s decompiled code.

Once we have executed the sample into the VM, we can check with Windbg that the malware unpacks a set of modules in memory:

After dumping these executables to disk we check that most of them are .Net executables, that we can decompile with dnSpy:

The malware contains code to steal credentials from different products:

2.2.1. Chromium Stealer

The malware is able to steal different information from Chromium Browsers:

The malware steals all the Chromium’s information from the browser’s sqlite database.

2.2.1.1. Cookies

It reads the cookies table from the sqlite database.

2.2.1.2. Credentials

It reads the logins table from the sqlite database.

2.2.1.3. Auto Fills

It reads the autofill table from the sqlite database.

2.2.1.4. Credit Cards

It reads the table credit_cards from the sqlite database.

2.2.2. Wallets Stealer

The malware is able to steal wallets from the following crypto-coin products:

2.2.3. Files From Personal Directories Stealer

The malware can steal files from Desktop, Favorites and Personal folders:

2.2.4. Discord Software Stealer

From wikipedia: “Discord is a proprietary freeware VoIP application and digital distribution platform designed for video gaming communities, that specializes in text, image, video and audio communication between users in a chat channel”.

The malware is able to steal information from this VoIP application by using a curious method. It calls DbgHelp.dll APIs (MiniDumpWriteDump) to create a minidump of any process containing the word “Discord” in the name.

Once the minidump file is created, it searchs the minidump for Discord json sessions by using a regex:

2.2.5. FileZilla Stealer

The malware reads credentials from FileZilla XML files:

2.2.6. Gecko Stealer

From wikipedia: “Gecko is a browser engine developed by Mozilla. It is used in the Firefox browser, the Thunderbird email client, and many other projects”.

The malware locates some Gecko important files:

It is able to recover credentials:

And cookies:

2.2.7. RDP Stealer

The malware can steal RDP credentials:

2.2.8. Telegram Stealer

The malware reads the files located at:

“%appdata%\Telegram Desktop\tdata\D877F783D5D3EF8C\map*”

From that files, it tries to recover Telegram sessions:

rule grandsteal { strings: $s1 = "ws://{0}:{1}/websocket" wide $s2 = "GrabBrowserCredentials: " wide $s3 = "GrabColdWallets: " wide $s4 = "GrabDesktopFiles: " wide $s5 = "GrabTelegram: " wide $s6 = "ColdWallets parser has been started" wide $s7 = "DiscordSession parser has been started" wide $s8 = "Rdps parser has been started" wide $s9 = "DesktopFiles parser has been started" wide $s10 = "FTPs parser has been started" wide $s11 = "TelegramSession parser has been started" wide $s12 = "ListOfProcesses parser has been started" wide $s13 = "ListOfPrograms parser has been started" wide $s14 = "card_number_encrypted" wide $s15 = "\\Litecoin\\wallet.dat" wide $s16 = "\\Bitcoin\\wallet.dat" wide $s17 = "\\Exodus\\exodus.wallet" wide $s18 = "\\Electrum\\wallets" wide $s19 = "\\Ethereum\\wallets" wide $s20 = "monero-project" wide $s21 = "Discord dump UNKNOWN" wide $s22 = "{0}\\FileZilla\\recentservers.xml" wide $s23 = "{0}\\FileZilla\\sitemanager.xml" wide $s24 = "cookies.sqlite" wide $s25 = "password-check" wide $s26 = "AppData\\Roaming\\Telegram Desktop\\tdata\\D877F783D5D3EF8C" wide $s27 = "%USERPROFILE%\\AppData\\Local\\Temp\\Remove.bat" wide $s28 = "taskkill /F /PID %1" wide $s29 = "choice /C Y /N /D Y /T 3 & Del %2" wide $s30 = "ExtractPrivateKey" wide $s31 = "formSubmitURL" wide $s32 = "passwordField" wide $s33 = "usernameField" wide $s34 = "GrabDiscord" wide $s35 = "encryptedPassword" wide $s36 = "masterPassword" wide $s37 = "WalletName" wide condition: (30 of them) }

Originally published at https://www.peppermalware.com.