信息窃取木马专项分析

---
name: infostealer-analysis
description: >
  Analyze information stealer malware families including AgentTesla, Rhadamanthys,
  RedLine, Raccoon, Lumma, and Vidar. Covers family identification via exfiltration
  channel analysis (SMTP, HTTP, Telegram, Discord), browser credential harvesting
  techniques, clipboard hijacking, cryptocurrency wallet targeting, C2 configuration
  extraction, and .NET deobfuscation. Use when analyzing suspected credential theft
  malware or investigating data exfiltration incidents.
---

# Infostealer Analysis

Analyze information stealer samples to identify the family, understand data
collection methods, map exfiltration channels, and extract C2 configurations
for detection and threat intelligence.

## Prerequisites

- **Python 3.8+**: `hashlib`, `json`, `re`, `os`, `sqlite3`, `struct` (standard library)
- **Python packages (optional)**: `pefile`, `yara-python`, `dnfile`, `pycryptodome`
- **Tools (recommended)**: dnSpy, de4dot, Ghidra/IDA Pro, x64dbg, Wireshark, Process Monitor
- **Environment**: Isolated VM with snapshots (populate with honeypot credentials for behavioral analysis)
- **References**: Malpedia infostealer entries, Any.Run public submissions

## Step-by-Step Instructions

### Step 1: Identify the Infostealer Family

Determine the family based on binary characteristics, exfiltration method, and behavioral markers.

**Run family identification:**
```bash
python3 scripts/infostealer_analyzer.py \
  --sample stealer.exe \
  --family auto \
  --output identification.json
```

**Quick triage with string analysis:**
```bash
# Check for .NET assembly (AgentTesla, RedLine, AsyncStealer)
file stealer.exe
python3 -c "
import pefile
pe = pefile.PE('stealer.exe')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    if b'mscoree.dll' in entry.dll.lower():
        print('.NET binary detected - likely AgentTesla/RedLine/Raccoon')
        break
"

# Look for exfiltration channel indicators
strings stealer.exe | grep -iE "(smtp|mail\.|telegram|api\.telegram|discord\.com/api/webhooks)"
strings stealer.exe | grep -iE "(Mozilla/|User-Agent|Content-Type|POST /)"
```

**Family identification markers:**

| Family | Language | Exfiltration | Key Indicators |
|--------|----------|-------------|----------------|
| AgentTesla | .NET (C#) | SMTP, HTTP, Telegram, FTP | Heavy obfuscation, `\|Sun\|` log delimiter |
| RedLine | .NET (C#) | Custom TCP (protobuf) | SOAP XML config, `StringDecrypt` class |
| Raccoon | C/C++ | HTTP POST | `machineId` param, RC4 encrypted config |
| Lumma | C/C++ | HTTP POST | Unique UA strings, `.bmp` URL paths |
| Vidar | C++ | HTTP POST | Sequential numbered C2 endpoints, DLL downloads |
| Rhadamanthys | C/C++ | HTTP/HTTPS | Shellcode stager, complex injection chain |

### Step 2: Analyze Browser Credential Harvesting

Infostealers target stored credentials, cookies, and autofill data from browsers.

**Identify targeted browser databases:**
```bash
# Check for browser database paths in strings
strings stealer.exe | grep -iE "(Login Data|logins\.json|cookies\.sqlite|Web Data)"
strings stealer.exe | grep -iE "(Chrome|Firefox|Edge|Opera|Brave)"
strings stealer.exe | grep -iE "(AppData|Local|Roaming|Application Data)"

# Check for SQLite operations
strings stealer.exe | grep -iE "(SELECT.*FROM|password_value|origin_url|encryptedUsername)"
```

**Browser data targets:**

| Browser | Credential Store | Cookie Store | Path Pattern |
|---------|-----------------|-------------|-------------|
| Chrome/Edge | `Login Data` (SQLite) | `Cookies` (SQLite) | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\` |
| Firefox | `logins.json` + `key4.db` | `cookies.sqlite` | `%APPDATA%\Mozilla\Firefox\Profiles\` |
| Opera | `Login Data` (SQLite) | `Cookies` (SQLite) | `%APPDATA%\Opera Software\Opera Stable\` |
| Brave | `Login Data` (SQLite) | `Cookies` (SQLite) | `%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\` |

**Check for Chrome master key decryption (DPAPI):**
```bash
strings stealer.exe | grep -iE "(CryptUnprotectData|DPAPI|Local State|encrypted_key|os_crypt)"
# Modern Chrome uses AES-GCM with a master key protected by DPAPI
# Stealers call CryptUnprotectData to decrypt the master key from Local State
```

### Step 3: Detect Clipboard Hijacking and Keylogging

Analyze clipboard monitoring and keystroke capture capabilities.

**Check for clipboard hijacking (crypto address replacement):**
```bash
strings stealer.exe | grep -iE "(SetClipboardData|GetClipboardData|ClipboardChanged|AddClipboardFormatListener)"
strings stealer.exe | grep -iE "(OpenClipboard|CF_TEXT|CF_UNICODETEXT)"

# Check for crypto wallet address regex patterns
strings stealer.exe | grep -iE "(\^[13][a-km-zA-HJ-NP-Z1-9]|^bc1|^0x[0-9a-fA-F]{40}|^[LM][a-km-zA-HJ-NP-Z1-9])"
```

**Check for keylogging capabilities:**
```bash
strings stealer.exe | grep -iE "(SetWindowsHookEx|GetAsyncKeyState|GetKeyState|GetKeyboardState)"
strings stealer.exe | grep -iE "(WH_KEYBOARD_LL|WH_KEYBOARD|LowLevelKeyboardProc)"

# Check for screenshot capture
strings stealer.exe | grep -iE "(BitBlt|GetDesktopWindow|GetDC|CopyFromScreen|Graphics\.CopyFromScreen)"
```

### Step 4: Analyze Cryptocurrency Wallet Targeting

Map which cryptocurrency wallets and extensions are targeted.

**Identify wallet targets:**
```bash
# Desktop wallet applications
strings stealer.exe | grep -iE "(wallet\.dat|electrum|exodus|atomic|jaxx|coinomi|guarda)"
strings stealer.exe | grep -iE "(Ethereum|Bitcoin|Monero|Litecoin|Zcash)"

# Browser extension wallets (identified by extension IDs)
strings stealer.exe | grep -iE "(nkbihfbeogaeaoehlefnkodbefgpgknn)"  # MetaMask
strings stealer.exe | grep -iE "(ibnejdfjmmkpcnlpebklmnkoeoihofec)"  # TronLink
strings stealer.exe | grep -iE "(fhbohimaelbohpjbbldcngcnapndodjp)"  # BinanceChain

# Check for wallet file search patterns
strings stealer.exe | grep -iE "(\.wallet|\.keys|\.json|wallet|vault)"
```

**Common wallet paths targeted:**

| Wallet | Data Location |
|--------|-------------|
| Bitcoin Core | `%APPDATA%\Bitcoin\wallet.dat` |
| Electrum | `%APPDATA%\Electrum\wallets\` |
| Exodus | `%APPDATA%\Exodus\exodus.wallet\` |
| MetaMask | Chrome extension local storage |
| Atomic | `%APPDATA%\atomic\Local Storage\leveldb\` |

### Step 5: Analyze C2 and Exfiltration Channels

Reverse engineer how stolen data is transmitted to the attacker.

**Run exfiltration analysis:**
```bash
python3 scripts/infostealer_analyzer.py \
  --sample stealer.exe \
  --family agenttesla \
  --output exfil_analysis.json
```

**SMTP exfiltration (AgentTesla):**
```bash
# Look for SMTP configuration
strings stealer.exe | grep -iE "(smtp\.|:587|:465|:25)"
strings stealer.exe | grep -iE "(mail\.from|mail\.to|SmtpClient|NetworkCredential)"

# Extract embedded SMTP credentials
python3 -c "
data = open('stealer.exe', 'rb').read()
import re
# Look for email patterns near SMTP config
emails = re.findall(rb'[\w\.-]+@[\w\.-]+\.\w{2,}', data)
for email in set(emails):
    print(f'Email found: {email.decode(errors=\"ignore\")}')
"
```

**HTTP POST exfiltration (RedLine, Raccoon, Lumma, Vidar):**
```bash
# Monitor network traffic during execution
# Look for POST requests with stolen data
strings stealer.exe | grep -iE "(POST |Content-Type.*multipart|boundary=)"
strings stealer.exe | grep -iE "(machineId|configId|hwid|build_id)"

# Vidar-specific: numbered C2 endpoints
strings stealer.exe | grep -iE "(/\d+$|/\d+\.php)"
```

**Telegram Bot API exfiltration:**
```bash
# Extract bot tokens and chat IDs
strings stealer.exe | grep -iE "(api\.telegram\.org/bot|sendDocument|sendMessage)"
strings stealer.exe | grep -oP "\d{8,10}:[A-Za-z0-9_-]{35}"  # Bot token format
strings stealer.exe | grep -oP "chat_id=(-?\d+)"               # Chat ID
```

**Discord webhook exfiltration:**
```bash
strings stealer.exe | grep -iE "(discord\.com/api/webhooks/|discordapp\.com/api/webhooks/)"
```

### Step 6: Extract Configuration Data

Extract embedded configurations including C2 URLs, campaign IDs, and builder settings.

**Configuration extraction by family:**
```bash
python3 scripts/infostealer_analyzer.py \
  --sample stealer.exe \
  --family redline \
  --output config.json
```

**AgentTesla .NET config extraction:**
```bash
# Deobfuscate with de4dot first
de4dot stealer.exe -o stealer_clean.exe

# Use dnSpy to inspect the cleaned binary
# Look for class with SMTP/FTP/Telegram configuration fields
# Common class names: Settings, Config, MailConfig

# Automated extraction of .NET string resources
python3 -c "
import dnfile
dn = dnfile.dnPE('stealer_clean.exe')
for row in dn.net.mdtables.UserStrings:
    s = row.value
    if s and len(s) > 5:
        print(repr(s))
"
```

**RedLine config extraction (SOAP XML):**
```bash
# RedLine stores config as SOAP-serialized XML
strings stealer.exe | grep -iE "(IP|ID|Message|Key)" | head -30

# Look for base64-encoded config blocks
strings stealer.exe | grep -oP "[A-Za-z0-9+/]{40,}={0,2}" | while read b64; do
    echo "$b64" | base64 -d 2>/dev/null | strings
done
```

**Raccoon/Vidar config extraction:**
```bash
# These families download config from C2 on first contact
# Monitor initial HTTP request/response for config data
# Raccoon: RC4-encrypted config with machineId key
# Vidar: Config returned as plaintext profile with target paths
```

### Step 7: .NET Analysis Deep Dive (AgentTesla, RedLine)

Most commodity infostealers are .NET-based and heavily obfuscated.

**Deobfuscation workflow:**
```bash
# Step 1: Identify obfuscator
python3 -c "
import pefile
pe = pefile.PE('stealer.exe')
for entry in pe.DIRECTORY_ENTRY_RESOURCE if hasattr(pe, 'DIRECTORY_ENTRY_RESOURCE') else []:
    print(entry)
"

# Step 2: Apply de4dot deobfuscation
de4dot stealer.exe -o stealer_deobf.exe
# For specific obfuscators:
# de4dot stealer.exe -p cr  # Crypto Obfuscator
# de4dot stealer.exe -p sa  # SmartAssembly

# Step 3: Extract method calls related to credential theft
# Use dnSpy GUI or ILSpy CLI to decompile
ilspycmd stealer_deobf.exe -o ./decompiled/
grep -rn "CryptUnprotectData\|SQLite\|Login Data\|cookies" ./decompiled/

# Step 4: Identify string decryption routines
# AgentTesla often uses XOR or AES to decrypt strings at runtime
grep -rn "Decrypt\|FromBase64\|GetString\|Encoding" ./decompiled/ | head -30
```

### Step 8: Extract IOCs and Build Detections

Compile all indicators for threat intelligence and detection.

**Generate comprehensive IOC report:**
```bash
python3 scripts/infostealer_analyzer.py \
  --sample stealer.exe \
  --family auto \
  --output full_report.json
```

**Key IOCs to extract:**
- C2 server addresses (IP/domain)
- SMTP relay servers and credentials
- Telegram bot tokens and chat IDs
- Discord webhook URLs
- Campaign/build identifiers
- Mutex names
- User-Agent strings
- Dropped file paths and names

**YARA rule template for infostealers:**
```bash
# Check for stealer-specific API import combinations
strings stealer.exe | grep -iE "(CryptUnprotectData)" && \
strings stealer.exe | grep -iE "(SQLite)" && \
strings stealer.exe | grep -iE "(smtp|telegram|webhook)" && \
echo "High confidence: Infostealer behavior detected"
```

## Output Format

```json
{
  "family": "AgentTesla",
  "confidence": "high",
  "variant": ".NET SMTP exfiltrator",
  "identification_markers": {
    "binary_type": ".NET",
    "obfuscator": "Crypto Obfuscator",
    "exfil_method": "SMTP",
    "log_delimiter": "|Sun|"
  },
  "credential_targets": {
    "browsers": ["Chrome", "Firefox", "Edge", "Opera", "Brave"],
    "email_clients": ["Outlook", "Thunderbird", "Foxmail"],
    "ftp_clients": ["FileZilla", "WinSCP", "CoreFTP"],
    "vpn_clients": ["NordVPN", "OpenVPN", "ProtonVPN"]
  },
  "crypto_targets": {
    "desktop_wallets": ["Bitcoin Core", "Electrum", "Exodus", "Atomic"],
    "browser_extensions": ["MetaMask", "TronLink", "Binance Wallet"],
    "clipboard_hijacking": true,
    "replacement_addresses": {
      "BTC": "bc1q...",
      "ETH": "0x..."
    }
  },
  "capabilities": {
    "keylogging": true,
    "screenshot_capture": true,
    "clipboard_monitoring": true,
    "webcam_capture": false,
    "file_grabber": true
  },
  "exfiltration": {
    "method": "SMTP",
    "smtp_server": "mail.example.com",
    "smtp_port": 587,
    "smtp_user": "exfil@example.com",
    "recipient": "attacker@example.com",
    "telegram_bot_token": null,
    "discord_webhook": null
  },
  "configuration": {
    "campaign_id": "Office2024",
    "mutex": "AsyncMutex_6SI8OkPnk",
    "install_path": "%APPDATA%\\svchost.exe",
    "persistence": "Registry Run key",
    "builder_version": "v4.0"
  },
  "iocs": {
    "c2_servers": ["mail.example.com"],
    "file_hashes": {
      "md5": "abc123...",
      "sha256": "def456..."
    },
    "mutex_names": ["AsyncMutex_6SI8OkPnk"],
    "dropped_files": ["%APPDATA%\\svchost.exe"]
  },
  "mitre_attack": ["T1555.003", "T1056.001", "T1115", "T1539", "T1041", "T1071.003"]
}
```

## Tips

- Populate your analysis VM with fake browser profiles, saved passwords, and dummy wallet files to trigger stealer behavior
- AgentTesla is the most common .NET stealer; always try de4dot deobfuscation first
- RedLine uses a custom TCP protocol with protobuf serialization; capture the full session for analysis
- Raccoon v2 downloads its DLL dependencies from the C2 server on first run (sqlite3.dll, nss3.dll)
- Vidar contacts numbered endpoints sequentially; the C2 response contains the target configuration
- Lumma Stealer frequently rotates C2 domains; extract the DGA or domain list from the binary
- Telegram bot tokens can be used to enumerate other victims by querying the bot's message history
- Discord webhook URLs can be reported to Discord Trust & Safety for takedown
- Check for anti-sandbox checks (Sleep calls, environment checks) that may prevent execution in analysis environments
- Many stealers now target 2FA authenticator app databases and password manager vaults
- Monitor for data exfiltration as ZIP or Base64-encoded log files containing structured stolen data