# NStealer v2

**URL:** <https://community.emergingthreats.net/t/nstealer-v2/974>\
**Category:** Rule Signatures\
**Created:** [September 21, 2023, 5:08pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974 "2023-09-21T17:08:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![g0njxa](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/g0njxa/32/364_2.png) [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\
**Post date:** [September 21, 2023, 5:08pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974/1 "2023-09-21T17:08:44Z")

</div>

A java based stealer has been spotted today over youtube compromised accounts. The log file produced by this malware was stored at Temp directory and thats how i could retrieve the name of this stealer

Sandbox Detonation  
[Analysis https://workupload.com/file/FJBNwrgMrXQ Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/f70eb75d-5bb0-4828-8fbb-7aaea2b66c94/)

Sample  
[MalwareBazaar | SHA256 5286e612ca35302536507939d609b47dac54b42b6c76238ab2aee60ec6204a0c (abuse.ch)](https://bazaar.abuse.ch/sample/5286e612ca35302536507939d609b47dac54b42b6c76238ab2aee60ec6204a0c/)

![image](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/2f82ea36ddd36f380c922ce111aab0f914f20c2e.png)

Im not sure about the exfiltration method, but im sure some rules can be written to add detection to this emerging threat 😛

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [September 21, 2023, 10:00pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974/2 "2023-09-21T22:00:32Z")

</div>

hey @g0njxa - I’m looking now and will give you an update once I find something

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [September 25, 2023, 5:31pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974/3 "2023-09-25T17:31:13Z")

</div>

@g0njxa -

Okay, this is what I’ve got. I wasn’t able to get the sample to perform the exfiltration but I believe it is going to use Discord because it has this [Java Discord API](https://github.com/discord-jda/JDA) embedded within in the .jar and I observed DNS queries to Discord in my lab.

![Screenshot 2023-09-25 at 11.23.08 AM](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/e4e856698a33b2190b809e962083fa7579f293da.png)

I also found these classes under the title “execchain.noom1337” which is probably where most of the malicious code is but I haven’t made much progress making sense of it all.

![Screenshot 2023-09-25 at 11.26.06 AM](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/80e65b95e4b2feffa4d79d2c136a8426a1178a9c.png)

Based on the way that the archives are formatted the following sigs should already detect the exfiltration but I also created two new signatures that match the archive name format that is specific to nstealer. I’ll share the new sigs later today after they go live.

````auto
2029846 - ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
2035015 - ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
2035016 - ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
2843856 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2```
````

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [September 25, 2023, 10:01pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974/4 "2023-09-25T22:01:34Z")

</div>

Here are those sigs from today’s release

```auto
2048229 - ET MALWARE Win32/nstealer CnC Exfiltration (POST) M1
2048230 - ET MALWARE Win32/nstealer CnC Exfiltration (POST) M2

```