Unmasking the Dot Stealer – K7 Labs

MITRE Techniques

• [T1497.001] Virtualization/Sandbox Detection – Uses embedded username and machine-name blacklists to detect analysis environments and terminate if matched. Quote: [‘The sample has two sets of lists, one is with user name and other with System name. If the name matches … terminates by itself.’]
• [T1036] Masquerading – Self-copies into a user-specific folder and renames itself to “temporallogger.exe” to hide the original binary. Quote: [‘creates a new directory “Username + UserCash” and in that directory self-copies itself as “temporallogger.exe”.’]
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Creates and runs a .bat via cmd.exe to launch the copied binary and remove the original file. Quote: [‘Malware creates a .bat file for running the temporallogger.exe file using cmd.exe. It deletes the file after creating the process.’]
• [T1140] Deobfuscate/Decode Files or Information – Uses ROT13 to decode the Telegram token and ChatID prior to connecting. Quote: [‘Later it uses the Rot13 algorithm for decrypting a Telegram Token and a TelegramChatID which will be used to login to their account.’]
• [T1555.003] Credentials from Web Browsers – Extracts saved login credentials and stores them in a temporary SQL database (login_data_db). Quote: [‘Login information is collected from the browser profile and stored in a database by creating a temporary login_data_db file.’]
• [T1539] Steal Web Session Cookies – Extracts cookie records including host_key, name, and encrypted_value from browser cookie storage. Quote: [‘It extracts details like host_key, name, encrypted_value.’]
• [T1074] Data Staged – Aggregates desktop files into DesktopFiles.zip and stores staged data under the user’s AppData roaming “UserCash” folder. Quote: [‘The malware combines all the desktop files as DesktopFiles.zip, and saves in the “C:UsersAdminAppDataRoamingAdminUserCash” folder.’]
• [T1113] Screen Capture – Takes screenshots of the desktop to include in the staged data prior to exfiltration. Quote: [‘As seen in the image below, the malware takes the screenshot of the desktop.’]
• [T1070.004] Indicator Removal on Host: File Deletion – Deletes the original DotStealer.exe after creating and launching the temporary runner to reduce discovery. Quote: [‘Batch file first deletes the original DotStealer.exe file and then starts executing temporallogger.exe file thus, the user cannot find the original malware file.’]
• [T1567.002] Exfiltration Over Web Service – Sends the staged ZIP file to an attacker-controlled Telegram account using the decoded token and ChatID. Quote: [‘It sends the .zip file through Telegram.’]