From GitHub to SMTP: Dissecting a Modern Information Stealer Exfiltration 

Author: Danyal Rana

Executive Summary

During dynamic analysis, the analyzed Windows executable exhibited the behavior of a sophisticated multi-stage information stealer employing multiple living-off-the-land techniques, encrypted communications, staged payload delivery, and modular data exfiltration.

Rather than immediately performing credential theft, the initial executable functioned primarily as a loader. Runtime telemetry showed the malware spawning legitimate Windows binaries, downloading additional components from GitHub infrastructure, performing public IP reconnaissance, and establishing repeated encrypted SMTP sessions for data exfiltration.

Memory analysis of the unpacked runtime payload revealed an extensive .NET-based credential stealing framework containing functionality for browser credential theft, cookie extraction, cryptocurrency wallet harvesting, clipboard monitoring, screenshot capture, keylogging, credit card recovery, Windows Defender tampering, and optional ransomware functionality.

The combination of static runtime behavior, recovered in-memory artifacts, and captured network traffic demonstrates a mature malware architecture that separates initial execution from the primary payload while encrypting most post-compromise communications.

Sample Information

Initial Loader

SHA256

 
993030fd181cc67dcaa0948f536539aff5ae10bce1aff5265018aa335365e802
 

Recovered In-Memory Payload

SHA256

 
6bab66754f9e140a8f0e55a0293203c37c1dd2d91dd5c0922029e5bb969075e3
 

Execution Overview

Upon execution, the sample did not immediately begin stealing data.

Instead, it performed a staged execution chain consistent with modern malware loaders.

Observed execution included:

  • spawning additional processes
  • execution through legitimate Windows binaries
  • runtime payload loading
  • external network communication
  • repeated encrypted SMTP sessions
  • post-execution payload activity

The staged nature of execution significantly complicates detection using traditional static signatures since the initial executable contains only part of the overall functionality.

Process Activity

Sandbox telemetry showed execution progressing through multiple legitimate Windows components before the final managed payload became active.

Observed process activity included:

  • execution of the original loader
  • child process creation
  • invocation of jsc.exe
  • execution of RegAsm.exe
  • associated conhost.exe instances
  • COM-related activity involving CMSTPLUA

This execution pattern is consistent with loader frameworks that abuse trusted Windows binaries for payload staging and execution.

Rather than directly executing the final payload from disk, execution is fragmented across multiple processes, reducing behavioral visibility.

Runtime Payload Recovery

Memory acquisition performed during execution recovered a second-stage managed payload.

Unlike the initial executable, the recovered payload exposed a comprehensive credential stealing framework containing numerous retained symbols, asynchronous method names, internal namespaces, and configuration objects.

Recovered functionality included:

  • browser credential recovery
  • browser cookie extraction
  • browser credit card recovery
  • cryptocurrency wallet extraction
  • clipboard logging
  • screenshot capture
  • keylogging
  • file grabbing
  • Discord exfiltration
  • Telegram exfiltration
  • SMTP exfiltration
  • FTP upload capability
  • configuration decryption
  • Windows Defender modification
  • anti-analysis routines
  • optional ransomware functionality

The large amount of preserved runtime metadata suggests the payload was compiled with minimal symbol stripping, greatly simplifying capability identification during memory analysis.

Browser Credential Theft

The recovered payload contains dedicated recovery routines for Chromium- and Gecko-based browsers.

Recovered functionality indicates support for:

  • saved credentials
  • browser cookies
  • session cookies
  • stored credit cards
  • browser profiles
  • multiple Chromium installations
  • Firefox-based browsers

Rather than targeting a single browser, the malware implements generic browser enumeration routines capable of identifying multiple Chromium-derived installations automatically.

Cryptocurrency Wallet Harvesting

Runtime analysis identified dedicated wallet extraction routines.

Recovered functionality indicates support for:

  • desktop wallet discovery
  • browser wallet discovery
  • wallet registry enumeration
  • wallet directory enumeration
  • browser wallet extensions

The malware appears capable of harvesting both standalone wallet applications and browser extension wallets.

Credential Collection

Recovered modules demonstrate dedicated routines for collecting:

  • browser passwords
  • cookies
  • browser sessions
  • saved credit cards
  • clipboard contents
  • screenshots
  • keyboard input

The modular design allows each collection routine to operate independently before forwarding recovered information through the configured exfiltration channel.

Multi-Channel Exfiltration

One notable characteristic of the recovered payload is its modular exfiltration architecture.

Recovered functionality supports multiple independent delivery mechanisms, including:

  • SMTP
  • Discord
  • Telegram
  • FTP

Each data collection module contains dedicated transmission routines for every supported communication channel.

Rather than implementing a single upload mechanism, the malware allows operators to choose one or more delivery methods during configuration.

Configuration System

Recovered runtime metadata indicates the presence of an extensive configuration system.

Configuration fields reference:

  • SMTP server
  • SMTP sender
  • SMTP recipient
  • SMTP authentication
  • Telegram Bot API token
  • Telegram chat ID
  • Discord webhook
  • FTP host
  • FTP credentials
  • grabber host
  • feature enable/disable controls

Configuration decryption routines utilizing AES-based cryptography were also recovered, indicating runtime configuration is protected prior to execution.

Windows Defender Tampering

Recovered functionality contains dedicated routines intended to modify Microsoft Defender settings.

Observed functionality references:

  • Defender registry modification
  • Group Policy modification
  • Windows Defender exclusions
  • Defender status checks

Such functionality may be used to reduce host-based detection prior to credential theft.

Anti-Analysis

The runtime payload also contains several anti-analysis features.

Recovered functionality references:

  • sandbox detection
  • debugger detection
  • thread hiding
  • debug object inspection
  • kernel debugger checks
  • process debug flags

These routines may be used to terminate execution or alter behavior when malware analysis environments are detected.

Network Activity

Network traffic captured during execution revealed several distinct phases.

GitHub Infrastructure

Early execution established encrypted TLS sessions with:

  • github.com
  • release-assets.githubusercontent.com

Traffic volume suggests interaction with GitHub Release infrastructure rather than simple connectivity testing.

Because communications occurred over TLS, the specific repository or downloaded asset could not be recovered from packet capture alone.

Public IP Discovery

The malware repeatedly queried:

 
icanhazip.com
 

This behavior is commonly used to determine the victim’s public-facing IP address before transmitting collected data to the operator.

Multiple requests were observed during execution.

SMTP Communication

The most significant network activity consisted of repeated SMTP sessions directed toward:

 
mail.trimnt.com
 

over TCP port 587.

Each observed session followed the same pattern:

 
EHLO <hostname>

STARTTLS
 

After TLS negotiation, all communications became encrypted.

Five separate SMTP sessions were observed during execution.

The repeated encrypted sessions strongly suggest staged or modular exfiltration, where different components upload collected information independently.

Traffic Characteristics

Captured network traffic indicates communication with:

  • GitHub
  • GitHub Release Assets
  • SMTP infrastructure
  • public IP discovery service

Additional Microsoft infrastructure observed during execution was consistent with normal Windows background activity and was not attributed to malicious functionality.

Behavioral Assessment

Dynamic analysis demonstrates a modular malware architecture consisting of:

  1. Initial loader execution
  2. Payload staging
  3. Managed payload execution
  4. Credential collection
  5. Public IP discovery
  6. Encrypted SMTP communication
  7. Modular exfiltration

The separation between loader and payload significantly complicates detection, while encrypted SMTP traffic limits visibility into stolen data without endpoint telemetry.

The recovered runtime payload further indicates that the malware supports multiple operator-configurable exfiltration methods, allowing campaigns to adapt to different operational requirements without modifying the underlying code.

(IOCs)

Sample Hashes

Initial Loader

SHA256

 
993030fd181cc67dcaa0948f536539aff5ae10bce1aff5265018aa335365e802
 

Recovered Runtime Payload

SHA256

 
6bab66754f9e140a8f0e55a0293203c37c1dd2d91dd5c0922029e5bb969075e3
 

Domains

 
github.com
release-assets.githubusercontent.com
icanhazip.com
mail.trimnt.com
 

IP Addresses

 
140.82.121.4
185.199.110.133
104.16.185.241
45.66.248.2
 

Observed Protocols

 
HTTPS (TLS)
SMTP (STARTTLS)
HTTP
DNS
 

Conclusion

This malware represents a mature, modular information stealer that separates its initial execution from its primary credential theft payload through staged execution. Dynamic analysis revealed extensive functionality for browser credential harvesting, cookie theft, wallet extraction, clipboard monitoring, keylogging, screenshot capture, and encrypted multi-channel exfiltration. Communication with GitHub infrastructure, public IP discovery services, and repeated SMTP sessions protected by STARTTLS demonstrates an emphasis on operational flexibility and reduced network visibility. While the encrypted communications prevented recovery of the exact payloads or exfiltrated content, the combined evidence from runtime behavior, memory acquisition, and network telemetry provides a comprehensive view of the malware’s operational workflow and post-compromise capabilities.