Xehook Stealer

The initial entry point may originate via spam emails.

User Execution (T1204) The user needs to manually execute the file.

Subsequently, it injects the stealer payload into the RegAsm.exe process. It utilizes functions such as VirtualAlloc, VirtualProtect, and WriteProcessMemory.

The initial file is a 32bit .NET loader which is obfuscated using a crypter.

Software Packing (T027.002) Binary may include packed or crypted data.

Subsequently, it injects the stealer payload into the RegAsm.exe process. It utilizes functions such as VirtualAlloc, VirtualProtect, and WriteProcessMemory.

After the upload operation, the code deletes the uploaded file from the victim’s system, potentially erasing any theft traces.

The loader proceeds to decrypt the encrypted stealer payload contained within a byte array. This decryption occurs in two stages: the data undergoes mathematical operations and XORing.

Next, the malware utilizes DateTime.Now.Ticks method to perform a Tick count. It is a known Anti-Analysis technique utilized by the environment to detect the sandbox environment.

The stealer examines the data from the WMI query to determine if the computer is running in a virtual environment. It terminates itself if it finds strings like “VMware” or “VirtualBox.”

Then, it employs the GetProcesses() method to retrieve the current list of running processes. It then compares these process names with the decrypted ones to determine if any match exists and terminates itself.

Now, the stealer binary uses the Windows Management Instrumentation (WMI) query “Select * from Win32_ComputerSystem” to gather information about the computer system.

The Xehook stealer verifies the configuration data to identify files to extract from the victim’s system. The TA can define any file extension within the configuration, prompting the stealer to capture and transmit the specified files.

Next, the malware utilizes DateTime.Now.Ticks method to perform a Tick count. It is a known Anti-Analysis technique utilized by the environment to detect the sandbox environment.

The stealer examines the data from the WMI query to determine if the computer is running in a virtual environment. It terminates itself if it finds strings like “VMware” or “VirtualBox.”

Then, it employs the GetProcesses() method to retrieve the current list of running processes. It then compares these process names with the decrypted ones to determine if any match exists and terminates itself.

The TA claimed that this stealer gathers a wide range of data, including passwords, cookies, autofill information, and credit cards from browsers, alongside sessions from messaging platforms like Telegram and Discord.

Archive Collected Data (T1560) Stealer compress the stolen data with ZIP extension.

Then, the malware starts exfiltrating the data using a POST request. It exfiltrates the data to the following URL: hxxps://trecube[.]com/gate.php...

the stealer is performing a GET request to get the following configuration

Spamhaus Researchers observed a new version of "Xehook Stealer" downloaded by Smokeloader.