Valkyrie Systems

Malware Analysis Report: load.exe - Info Stealer

Executive Summary

This binary is a MALICIOUS INFO STEALER disguised as a Nuitka-compiled Python application. Despite using legitimate Nuitka packaging, the payload contains sophisticated credential theft capabilities.

Risk Assessment: CRITICAL - MALWARE

Key Findings

• C2 Server: https://auth.requiem.technology
• Type: Info Stealer / Credential Harvester
• Targets: Browser credentials, cookies, crypto wallets, Discord tokens, clipboard
• Packer: Custom XOR-encrypted Nuitka onefile with VM-obfuscated unpacker
• Payload Size: ~34 MB (decompressed), contains Python 3.11 runtime and malicious DLL

---

Threat Intelligence

Command & Control Infrastructure

Targeted Data

---

Binary Structure

Original Executable (load.exe)

PE Sections (Packer)

Entry Point Redirection

• Real Entry: 0x140051370 → Redirects to .dtQyA packer section
• Packer Entry: 0x14015FBC2 → VM-based obfuscated unpacker

---

Encryption Analysis

Payload Encryption

Resource Details

---

Extracted Payload Contents

Successfully extracted 32 files (34.4 MB decompressed):

Main Malware Component

Python Runtime

Crypto/Network Libraries

Windows Integration

System Enumeration

Data Handling

---

Malicious Capabilities

1. Browser Credential Theft

• Targets Chrome, Firefox, Edge, Opera, Brave browsers
• Steals saved passwords from "Login Data" SQLite databases
• Extracts cookies for session hijacking
• Harvests autofill data and credit card information

2. System Reconnaissance

• Uses psutil library for comprehensive system enumeration
• Collects hostname, username, hardware info
• Gathers IP address and network configuration
• Detects installed software and running processes

3. Clipboard Monitoring

• 8 references to clipboard functionality
• Likely monitors for cryptocurrency addresses and passwords

4. Keylogging Capability

• 6 references to keylogger-related functionality
• Captures keystrokes for credential harvesting

5. Data Exfiltration

• Sends stolen data to https://auth.requiem.technology
• Uses HTTPS for encrypted C2 communication
• Employs requests and urllib3 libraries

---

Indicators of Compromise (IOCs)

Network Indicators

https://auth.requiem.technology

File Indicators

Strings Indicators

auth.requiem.technology
cookies
Login Data
passwords
clipboard
psutil
win32security

Mutex/Registry Keys

Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\Internet Settings

---

Decryption Method

The payload was successfully extracted using the following method:

1. Locate XOR key at VA 0x14015FE44 in .dtQyA section
2. XOR decrypt the resource at file offset 0xc0f4a0 with 256-byte key
3. Strip KAY header (3 bytes)
4. Zstd decompress the remaining data
5. Parse Nuitka format: UTF-16LE filename + null + 4-byte size + data

Key Script

# XOR decryption key (first 64 bytes)
key = bytes.fromhex("90370675869a9fe01de6a9f5cede87fcb7704b7674f0b4e59943974b7880144d...")

# Read encrypted resource
with open("load.exe", "rb") as f:
    f.seek(0xc0f4a0)
    encrypted = f.read(9726904)

# Simple XOR decryption
decrypted = bytes(encrypted *^ key for i in range(len(encrypted)))

# Skip "KAY" header and decompress
import zstandard as zstd
dctx = zstd.ZstdDecompressor()
payload = dctx.stream_reader(io.BytesIO(decrypted[3:])).read()

---

Packer Analysis

Obfuscation Techniques

1. Custom PE Sections: .4enk5, .QZfVg, .dtQyA with random names
2. Entry Point Redirection: Real entry jumps to packer in .dtQyA
3. VM-Style Dispatch: Jump chain obfuscation in .4enk5 section
4. XOR Encryption: 256-byte repeating key for payload encryption
5. Control Flow Flattening: 15+ functions with CFF detected

Packer Functions

---

Recommendations

Immediate Actions

1. Block C2: Add auth.requiem.technology to firewall/proxy blocklists
2. Quarantine: Remove load.exe and any extracted files
3. Credential Reset: Reset all browser-saved passwords
4. Session Invalidation: Invalidate all active sessions (Discord, banking, etc.)
5. Monitor: Check for unusual network connections to the C2 domain

Detection Rules

# Yara Rule
rule Requiem_InfoStealer {
    strings:
        $c2 = "auth.requiem.technology" ascii wide
        $kay = "KAY" ascii
        $section1 = ".4enk5" ascii
        $section2 = ".dtQyA" ascii
        $key = { 90 37 06 75 86 9a 9f e0 }
    condition:
        uint16(0) == 0x5A4D and ($c2 or (2 of ($section*, $key)))
}

---

Files Generated

---

Conclusion

This malware is a sophisticated info stealer that:

1. Uses legitimate Nuitka packaging for evasion
2. Employs custom XOR encryption + VM-obfuscated packer to hide payload
3. Targets browser credentials, cookies, crypto wallets, and clipboard
4. Exfiltrates data to auth.requiem.technology via HTTPS
5. Contains keylogging capabilities

The malware was successfully unpacked without execution using static analysis and the discovered XOR key.

---

Report generated via IDA Pro MCP + static analysis
All payload files extracted safely without malware execution

Credits to Moash - INSTANT CLEAN EVERYTHING!*