Malware Analysis September 18, 2026

Info-Stealer / RAT

.NET Executable | x86 (32-bit)

Sentry North Verdict: MALICIOUS Confidence: 98%
3 Anti-Analysis Techniques
2 Keylogging Methods
18 MITRE Techniques
Critical Threat Severity

Analysis Summary

This .NET-based information stealer demonstrates sophisticated capabilities for credential theft, surveillance, and data exfiltration. It captures keystrokes, screenshots, and clipboard data while using anti-analysis techniques to evade detection in virtual machines and sandboxes. The malware communicates over HTTP and FTP to exfiltrate stolen data.

SHA256: 0de09d55351a5e10c4f51dd12b0edb385eb56da86d54d80276915116a0c847ad
MD5: 89a42088178e5c5778bcef4b02930b14
Type: .NET Executable
💡 In Plain English

What is this? This is an information stealer - a type of malware designed to secretly collect sensitive data from your computer. It runs silently in the background, recording everything you type (including passwords), taking screenshots of your screen, and copying anything you paste from your clipboard.

How does it steal your information? The malware uses 'hooks' - a technique that lets it intercept your keyboard and mouse inputs before they reach any application. Every password you type, every credit card number you enter, every private message you write - it all gets captured and sent to the attacker.

Why is it hard to detect? This malware checks if it's running inside a security researcher's virtual machine (VMware, VirtualBox) or automated analysis sandbox. If it detects these environments, it can change its behavior to avoid detection. It also encrypts its communications to hide what data it's stealing.

Detected Capabilities

Collection & Surveillance

Keystroke Logging (Hook-based) T1056.001

Captures all keyboard input using Windows application hooks

Keystroke Logging (Polling) T1056.001

Alternative method polling keyboard state to capture input

Screenshot Capture T1113

Takes screenshots of the victim's desktop

Clipboard Monitoring T1115

Reads data copied to the clipboard (passwords, crypto addresses)

Anti-Analysis & Evasion

VMware Detection T1497.001

Detects if running in VMware virtual machine

VirtualBox Detection T1497.001

Detects if running in VirtualBox virtual machine

Sandbox/AV Detection T1497.001

Checks for security analysis environments

Debugger Detection T1622

Detects if being analyzed in a debugger

Mark of the Web Bypass T1553.005

Evades Windows security warnings for downloaded files

Data Exfiltration

HTTP Communication T1071.001

Sends stolen data via HTTP requests

FTP File Transfer T1048

Uploads stolen files via FTP protocol

Network Credential Access T1555

Manipulates stored network credentials

Encryption & Obfuscation

AES Encryption T1027

Encrypts data using AES algorithm

DPAPI Encryption T1027

Uses Windows Data Protection API for encryption

Base64 Encoding T1140

Encodes data for transmission

Discovery & Reconnaissance

System Information T1082

Gathers OS version, hardware info

Process Enumeration T1057

Lists running processes to identify targets

File System Discovery T1083

Searches for sensitive files

WMI Queries T1047

Uses Windows Management Instrumentation for system info

Would Sentry North Have Stopped This?

✓
Yes. Sentry North's detection engine identified this threat through multiple detection layers.

Detection Points

Static Analysis
Capability Detection
Sentry North's ML-powered analysis immediately identifies keylogging hooks, screenshot capture, and clipboard access capabilities in the binary before it ever runs.
Static Analysis
Anti-Analysis Detection
The VM/sandbox detection strings and debugger checks are flagged as evasion techniques - a strong indicator of malicious intent.
Behavioral Analysis
Hook Installation
When the malware attempts to install keyboard hooks (SetWindowsHookEx), Sentry North detects this suspicious behavior pattern.
Behavioral Analysis
Credential Access
Attempts to access DPAPI-protected credentials or manipulate network authentication trigger credential theft alerts.
Network Monitoring
Data Exfiltration
Suspicious outbound HTTP/FTP connections carrying encoded data are flagged as potential exfiltration.

🔍 Technical Deep Dive

MITRE ATT&CK Coverage

T1056.001 Input Capture: Keylogging Collection
T1113 Screen Capture Collection
T1115 Clipboard Data Collection
T1497.001 Virtualization/Sandbox Evasion Defense Evasion
T1553.005 Mark-of-the-Web Bypass Defense Evasion
T1071.001 Application Layer Protocol: Web Command and Control
T1048 Exfiltration Over Alternative Protocol Exfiltration
T1027 Obfuscated Files or Information Defense Evasion
T1082 System Information Discovery Discovery
T1057 Process Discovery Discovery
T1083 File and Directory Discovery Discovery
T1047 Windows Management Instrumentation Execution

Indicators of Compromise

File Hashes

SHA256:0de09d55351a5e10c4f51dd12b0edb385eb56da86d54d80276915116a0c847ad
MD5:89a42088178e5c5778bcef4b02930b14

Behavioral Indicators

  • SetWindowsHookEx calls for keyboard/mouse hooks
  • Enumeration of VMware/VirtualBox registry keys
  • Access to clipboard via OpenClipboard/GetClipboardData
  • Screenshot capture via Graphics.CopyFromScreen
  • FTP connections for file upload

Recommendations

  • Block execution of unknown .NET executables from untrusted sources
  • Monitor for SetWindowsHookEx API calls from non-system processes
  • Enable credential guard to protect against DPAPI-based theft
  • Alert on outbound FTP connections from workstations
  • Use application whitelisting to prevent unauthorized executables