Sample
- SHA256
-
94237eac80fd2a20880180cab19b94e8760f0d1f06715ff42a6f60aef84f4adf - Difficulty
- medium
- Platform
- Windows
- Tags
- python stealer
- Likes
- 1
- Views
- 2
- Submitter
- humpty_tony
Analysis
Goal
This post’s goal is to show how you reverse a “boring” stealer by treating the loader chain as the real specimen.
Peel multi-stage Python loaders safely:
- Identify and undo container transforms (reverse bytes + zlib).
- Recognize when crypto code is “almost right” but relies on a modified library (the PyAES GCM mismatch), then swap in a compatible implementation to decrypt without executing.
- Deal with Python marshalled bytecode.
- Reduce obfuscation to primitives (base64 aliasing, rot13, marshal.loads, LZMA/XZ payloads, BlankOBF patterns), so you can turn “giant blob soup” into discrete stages you can write to disk, identify with file, and decompile.
So the analysis goal is basically: build a repeatable methodology for unpacking + staging + version-correct decompilation of Python malware—because that workflow applies to tons of commodity stealers and loaders.
Description
The sample (“Velocity.exe”) is a 64-bit Windows PyInstaller-packed dropper whose purpose is to deliver BlankGrabber. The interesting bit isn’t BlankGrabber itself (well-documented), but the multi-stage loader:
- PyInstaller container → extracts a main .pyc loader.
- That loader reads an embedded file (blank.aes), applies byte-reversal + zlib, then decrypts it with AES-GCM using a modified PyAES implementation, and loads a module (stub-o).
- stub-o is mostly obfuscation glue that unwraps a compressed XZ/LZMA stage (and more layered Python obfuscation + marshal payloads).
- After fixing the Python 3.13 mismatch, the final marshalled code can be dumped back into a .pyc for normal decompilation.
Final payload behavior matches a typical commodity stealer, including:
- Sandbox/VM checks (UUID/hostname/username blacklists, hosting-IP checks, VirtualBox/VMware artifacts).
- Browser theft focused on Chromium (passwords, cookies, history, autofill).
- Discord-focused theft: collects account/payment metadata and performs client injection (AppData modification) to steal tokens/credentials and payment details.
- Session theft across gaming/messaging apps (Discord/Telegram/Steam/etc.) and crypto wallet targeting (notably MetaMask extension IDs).
- Additional post-compromise features: screenshots, clipboard, webcam capture, Wi-Fi credential collection, persistence tricks, UAC bypass attempts, website blocking, and Defender tampering.
Recommended Tools
python unpacme
Image
Comments
Please login to view and post comments.