New Advanced Stealer (SHUYAL) Targets Credentials Across 19 Popular Browsers

 Author(s): Vlad Pasca

• New advanced stealer analyzed though Hybrid Analysis and named 'SHUYAL' 
• Hybrid Analysis report reveals the stealer can grab credentials from 19 different web browsers (Chrome, Brave, Edge, Opera, OperaGx, Yandex, Vivaldi, Chromium, Waterfox, Tor, Epic, Comodo, Slimjet, Coccoc, Maxthon, 360browser, Ur, Avast and Falkon)
• SHUYAL features advanced evasion tactics, featuring self-deletion capabilities and sophisticated anti-detection mechanisms, including automatic Task Manager disablement
• The stealer employs modern exfiltration methods, combining Discord token theft with Telegram-based data exfiltration 

Hybrid Analysis has analyzed a sophisticated new information stealer that combines extensive credential theft capabilities with advanced system reconnaissance and evasion tactics. Named SHUYAL based on unique identifiers discovered in the executable's PDB path, this previously undocumented stealer demonstrates comprehensive browser targeting, grabbing credentials from 19 different browsers ranging from mainstream applications like Chrome and Edge to privacy-focused options such as Tor.

Analysis shows SHUYAL performing thorough system reconnaissance, gathering detailed information about disk drives, input devices, and display configurations. The malware employs aggressive defense evasion techniques, including the automatic termination and subsequent disabling of Windows Task Manager. Beyond credential theft, SHUYAL captures system screenshots and clipboard content, exfiltrating this data alongside stolen Discord tokens through a Telegram bot infrastructure. The malware maintains operational stealth through self-deletion mechanisms, removing traces of its activity using a batch file after completing its primary functions.

This research presents a detailed technical analysis of SHUYAL, documenting its capabilities and behaviors through comprehensive Hybrid Analysis indicators, combined with in-depth technical analysis of a publicly available sample.

A Hybrid Analysis Perspective

We’ve named this stealer SHUYAL based on the PDB path extracted from the executable. As we can see in the Hybrid Analysis report, the path also reveals the “sheepy” username:

Figure 1 - PDB path extracted in the Hybrid Analysis report

The malware disables Windows Task Manager on the machine by modifying the “DisableTaskMgr” registry value (see Figure 2).

Figure 2 - Disabling Windows Task Manager

The stealer tries to access login credentials from a list of browsers, including Google Chrome, Opera and Microsoft Edge. The entire list will be presented in the technical analysis.

Figure 3 - Multiple browsers are targeted by the stealer

Spawning multiple processes (as highlighted below), SHUYAL retrieves the model and serial number of the available disk drives, information about the keyboard and mouse installed on the machine, and details about the monitor attached to the computer. The last command (“wmic get name”) is incomplete and doesn’t return any useful information.

 Figure 4 - Multiple processes retrieve information about the infected host

Figure 5 from the Hybrid Analysis report reveals that the process uses PowerShell to compress a folder from the “%TEMP%” directory. The folder contains information to be exfiltrated, as we’ll see in the upcoming sections.

Figure 5 - Create an archive to be exfiltrated using PowerShell

The stealer performs data exfiltration via a Telegram bot (Figure 6).

Figure 6 - Data exfiltration occurs via Telegram

The malware is very stealthy because it deletes the newly created files from the browsers’ databases and all files from the “runtime” directory that were previously exfiltrated:

Figure 7 - Malware deletes the created files for stealthiness

The malicious process extracts the path of the Desktop Wallpaper using PowerShell, as shown in the figure below.

Figure 8 - Extract the path of the Desktop Wallpaper

A Deeper Dive into SHUYAL

The binary creates an anonymous pipe via a call to CreatePipe. The pipe will be used to read the output of the processes to be spawned:

Figure 9 - CreatePipe API call

Reconnaissance

The stealer performs reconnaissance by creating multiple processes:

• wmic diskdrive get model,serialnumber (retrieve the model and serial number of the available disk drives)
• wmic path Win32_Keyboard get Description,DeviceID (retrieve information about the keyboard)
• wmic path Win32_PointingDevice get Description,PNPDeviceID (created twice, retrieve information about the mouse)
• wmic path Win32_DesktopMonitor get Description,PNPDeviceID (retrieve details about the monitor attached to the computer)
• wmic get name (returns an error)
• powershell -command “(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper” (retrieve the path of the Desktop Wallpaper)

Figure 10 - Obtain information about the machine

The malware enumerates the running processes looking for the Task Manager process. If found, it is killed by calling the TerminateProcess method (see Figure 11).

Figure 11 - Task Manager process is stopped

The process disables Task Manager by modifying the “DisableTaskMgr” registry value to 1, as highlighted below:

Figure 12 - Disable Task Manager by modifying a registry value

Persistence

SHUYAL obtains the user’s Startup folder using the SHGetSpecialFolderPathA API (0x7 = CSIDL_STARTUP):

Figure 13 - SHGetSpecialFolderPathA API call

The malware establishes persistence by self-copying to the Startup folder via a function call to CopyFileA. We can also observe the strings that appear in the code, confirming the success/failure of the operation.

Figure 14 - Copy operation to the Startup folder

The stealer obtains a handle to the standard output device and adds the ENABLE_ECHO_INPUT mode to the output mode:

Figure 15 - Modify the console mode

Data stealing

SHUYAL attempts to locate the “Login Data” file, which stores login data (including usernames and URLs), for the following browsers: Chrome, Brave, Edge, Opera, OperaGx, Yandex, Vivaldi, Chromium, Waterfox, Tor, Epic, Comodo, Slimjet, Coccoc, Maxthon, 360browser, Ur, Avast and Falkon.

Figure 16 - GetFileAttributesExW API call

The identified files are copied to the current directory of the malware. For example, the file corresponding to Chrome is copied as “chrome_Data.db” (Figure 17).

Figure 17 - Copy targeted databases to the current directory

The following SQL query is executed, "SELECT origin_url, username_value, password_value FROM logins". The encrypted passwords will be decrypted and stored in a newly created file called “saved_passwords.txt” found in the “runtime” directory created in the temporary folder. The decryption works by extracting the Master key from the “Local State” file, base64-decode the key, and then decrypt it using the DPAPI CryptUnprotectData. The Master key can be used to decrypt the browser credentials. The browsing history is extracted from “\User Data\Default\History” and saved as “history.txt” in the same directory. Figure 18 presents the SQL query that is executed:

Figure 18 - SQL query execution

The process extracts data from the clipboard using the OpenClipboard and GetClipboardData functions. It is saved in a file called “clipboard.txt”:

Figure 19 - Extract data from the clipboard

Figure 20 - Data is saved in a file called clipboard.txt

The stealer takes a screenshot using the GdiplusStartup, BitBlt, and GdipSaveImageToFile APIs, and saves it in a file called “ss.png”:

Figure 21 - APIs used to take the screenshot

Figure 22 - GdipSaveImageToFile function call

It also steals tokens from Discord, Discord Canary, and Discord PTB (Figure 23).

Figure 23 - Malware steals tokens from Discord applications

The malware creates a log file called “debug_log.txt” that contains information about the targeted browsers and other applications:

Figure 24 - Content of the log file

Data exfiltration

The malicious executable compresses the “runtime” directory containing files to be exfiltrated to an archive called “runtime.zip” using PowerShell, as shown in the figure below.

Figure 25 - Folder to be exfiltrated is compressed to an archive

The archive is exfiltrated to the following Telegram bot:

Figure 26 - Telegram bot

WSAEnumNetworkEvents is utilized to discover occurrences of network events for a socket:

Figure 27 - WSAEnumNetworkEvents API call

After finishing the malicious activity, the stealer performs self-deletion using a batch file called “util.bat”:

Figure 28 - Content of the self-deletion batch script

Figure 29 - Execution of the newly created batch file

SHUYAL Through the Eyes of Hybrid Analysis

The Hybrid Analysis report identifies multiple behavioral patterns and indicators that clearly classify SHUYAL as a new,  information-stealing malware. For example, it highlights that the sample obtains login credentials from a list of browsers, including Google Chrome, Opera, Edge and others. Our in-depth technical analysis extends beyond behavioral observations to examine SHUYAL's core functionality, enabling the development of more effective detection and defense mechanisms.

Hybrid Analysis is a powerful platform for identifying and analyzing malware, whether mundane or highly sophisticated. It provides detailed context and information that can be investigated further during the dynamic analysis of the malware. For performing a more in-depth analysis of malware samples, you can download them by registering with a Hybrid Analysis account and becoming a vetted user.

Indicators of Compromise

SHA256

810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c

Files created

C:\Users\<User>\AppData\Local\Temp\runtime\browser\debug_log.txt

C:\Users\<User>\AppData\Local\Temp\runtime\browser\tokens.txt

C:\Users\<User>\AppData\Local\Temp\runtime\clipboard\clipboard.txt

C:\Users\<User>\AppData\Local\Temp\runtime\history\history.txt

C:\Users\<User>\AppData\Local\Temp\runtime\passwords\saved_passwords.txt

C:\Users\<User>\AppData\Local\Temp\runtime\pic\ss.png

C:\Users\<User>\AppData\Local\Temp\runtime.zip

util.bat

Processes spawned

wmic diskdrive get model,serialnumber

wmic path Win32_Keyboard get Description,DeviceID

wmic path Win32_PointingDevice get Description,PNPDeviceID

wmic path Win32_DesktopMonitor get Description,PNPDeviceID

wmic get name

powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper”

powershell -Command “Compress-Archive -Path ‘C:\Users\<User>\AppData\Local\Temp\runtime\*’ -DestinationPath ‘C:\Users\<User>\AppData\Local\Temp\runtime.zip’ -Force

Telegram Bot

hxxps[:]//api.telegram[.]org/bot7522684505:AAEODeii83B_nlpLi0bUQTnOtVdjc8yHfjQ/sendDocument?chat_id=-1002503889864

Recent Keylogger Attributed to North Korean Group Andariel Analyzed Through A Hybrid Analysis Perspective

Author: Vlad Pasca

• A technical deep dive into the new North Korean keylogger from a Hybrid Analysis perspective
• The keylogger incorporates junk code to hinder analysis and logs keystrokes and mouse activity, storing the data in a password-protected, encrypted archive
• The malware has been associated with a North Korean group targeting U.S. organizations

A new keylogger, attributed to the North Korean group Andariel (also known as APT45, Silent Chollima, or Onyx Sleet) has been recently disclosed and linked to targeted attacks against U.S. organizations. Using Hybrid Analysis we reveal some of the malware’s capabilities, including its ability to capture sensitive information through keystroke and mouse activity logging. Additionally, we conduct a deep dive into the keylogger’s anti-analysis techniques, such as code obfuscation through the use of junk code, implemented in an effort to hinder analysis. 

A Hybrid Analysis Perspective

Right at the top of the Hybrid Analysis report, the “Risk Assessment” section reveals that the malware sets a global Windows hook to intercept keystrokes and mouse events:

Figure 1 – Keylogger sets global hooks to intercept keystrokes and mouse events

Another important find in the Malicious Indicators section is that the keylogger installs a hook procedure monitoring low-level mouse input events (WH_MOUSE_LL), as highlighted in the figure below.

Figure 2 – API call with the WH_MOUSE_LL parameter

Expanding the “Spyware/Information Retrieval” malicious indicator reveals  that a hook procedure that monitors low-level keyboard input events (WH_KEYBOARD_LL) is also installed (Figure 3).

Figure 3 – API call with the WH_KEYBOARD_LL parameter

Moving forward to the Suspicious Indicators section and expanding the “Tries to save executable or command in registry” indicator, we notice the malicious process modifies the “(Default)” value found under the Run registry key in order to achieve persistence on the machine:

Figure 4 – Registry value modification detected by Hybrid Analysis

Expanding the “Found strings related to keylogger” indicator under the Spyware/Information Retrieval category part of the Informative indicators reveals multiple strings indicative of keylogger activity:

Figure 5 – Strings related to a potential keylogger were identified 

Finally, checking the Extracted Files section of the Hybrid Analysis report reveals the malware creates an archive called “DT_0004.tmp” in the “%TEMP%” directory, which may indicate where the keylogger logs are stored:

Figure 6 – A new file is created in the TEMP folder

A Deeper Dive into The Keylogger

Taking the sample apart by performing some additional manual analysis reveals an anti-analysis technique that is used to obscure the program’s execution flow and make malware analysis more difficult. This technique consists of adding a lot of junk code as shown in the instructions presented in Figure 7.

Figure 7 – Junk code seen in x64dbg

Payload Decryption

The binary stores a custom encrypted payload at a specific location found after 84 NULL bytes. It uses the ReadFile function to read the buffer:

Figure 8 – ReadFile API used to read the encrypted payload

The content is decrypted and an executable is revealed (see Figure 9). The PE file header is removed, and the rest of the content is copied to a new memory area.

Figure 9 – New executable is decrypted in memory

Moving forward, we have used PE-sieve to dump the malicious executable. The execution flow is redirected to the newly decrypted code using the instruction displayed below, where the target address (stored in  RSP+60) of the CALL instruction points to an executable address in the decrypted payload range.

Figure 10 – Redirect the execution flow to the decrypted payload

The SetErrorMode method is utilized to avoid displaying error message boxes when certain errors occur (0x8007 = SEM_NOOPENFILEERRORBOX | SEM_NOALIGNMENTFAULTEXCEPT | SEM_NOGPFAULTERRORBOX | SEM_FAILCRITICALERRORS):

Figure 11 – SetErrorMode API call

Persistence

Part of the persistence mechanism, the process opens the “Software\Microsoft\Windows\CurrentVersion\Run” registry key via a function call to RegCreateKeyExW:

Figure 12 – RegCreateKeyExW API call

It then modifies the “(Default)” registry value using the RegSetValueExW function to establish persistence on the machine.

Figure 13 – Persistence is achieved by modifying the registry value

Keylogging Installation

The binary installs two hook procedures that monitor low-level keyboard and mouse input events, as in the following pseudocode:

// Keyboard hooking

1. KeyboardHook = SetWindowsHookEx(

WH_KEYBOARD_LL, 

HookProcedure,

NULL,

   NULL 

);

2. MSG Msg;

3. while (GetMessageW(&Msg, NULL, 0, 0) > 0)

At line 1, the sample calls the  SetWindowsHookExW API specifying the following parameters:

• RCX: WH_KEYBOARD_LL (0xD), to monitor low-level keyboard input events
• RDX: the pointer to the hook procedure (described below in “Keylogger Routine”)
• R8: NULL, since the hook routine is within the code associated with the current process
• R9: NULL, to monitor all the existing threads running in the same desktop as the calling thread

At line 3., the binary uses the GetMessageW API to to obtain messages from the calling thread’s message queue, which will be stored in the first parameter (RCX: &Msg). Since the rest of the parameters are NULL,  the function retrieves all the messages for any window that belongs to the current thread and any thread messages, allowing keyboard events to be handled by the hooking procedure.

The installation of the hook procedure for mouse input events is very similar, with the first parameter being WH_MOUSE_LL (0xE).

Interestingly, a similar implementation of the keylogger mechanisms can also be found on GitHub. 

The new thread creates a file called “DT_0004.tmp” in the temporary folder. The file is a password protected archive that extracts a file called “a04.log”. The password is “Pass@w0rd#384”.

Figure 14 – A new file is created and will store the keylogger logs

In the new thread, the sample retrieves the current local date and time using the GetLocalTime method to track the starting time of the keylogger. It converts the output to file time format using SystemTimeToFileTime. The result will be stored in the log file before new keystrokes or mouse events are written.

Figure 15 – Local date and time will be written to the file when new events occur

The malware writes content to the archive one byte at a time. The first two written bytes are “PK”, which indicate that the file will be a ZIP archive:

Figure 16 – New file is populated

Keylogging Routine

When detecting new keystrokes or mouse events (see Figure 17), the keylogger hooking procedure (specified in the second parameter of  SetWindowsHookEx) extracts the text of the foreground window:

Figure 17 – Foreground window’s title is obtained using multiple APIs

The virtual-key code corresponding to keyboard keys or mouse buttons is compared with multiple values, as highlighted below:

Figure 18 – Virtual-key codes are compared with specific values

A partial list of virtual-key codes corresponding to special keys is displayed in the figure below.

Figure 19 – Special keys are recorded by the keylogger

The malicious process obtains the active input local identifier by calling the GetKeyboardLayout API:

Figure 20 – GetKeyboardLayout API call

ToUnicode is utilized to translate virtual-key codes and keyboard states to the corresponding Unicode character. For example, 0x50 key is translated to the “P” character:

Figure 21 – Virtual-key codes translation

On finishing the hook routine, the information is passed to the next hooking procedure in the hook chain using CallNextHookEx (Figure 22).

Figure 22 – Pass the hook information to the next hook procedure

The keylogger also steals data from the clipboard. It uses the OpenClipboard and GetClipboardData methods to achieve its objective:

Figure 23 – OpenClipboard and GetClipboardData API calls

An example of a log file is displayed below. Strings such as “[Lm]” and “[Rm]” are recorded when pressing the left mouse button and right mouse button, respectively.

Figure 24 – Example of a log file created by the keylogger

Through the Eyes of Hybrid Analysis

Hybrid Analysis has been able to identify the API calls used to install hook procedures and strings that might indicate keylogger activity, presenting all that information in a rich, detailed, and structured report. The keylogger’s persistence mechanism and the file created for storing logs are both revealed in the report, enabling threat hunters, analysts and researchers to quickly assess the impact and capabilities of the threat.

Hybrid Analysis is an ideal platform for identifying and analyzing  malware both sophisticated and mundane. It provides detailed context and information that can be investigated further during the dynamic analysis of the malware. For performing a more in-depth analysis of malware samples, you can download them by registering with a Hybrid Analysis account and becoming a vetted user.

Indicators of Compromise

SHA 256

d71f478b1d5b8e489f5daafda99ad203de356095278c216a421694517826b79a

File created

%TEMP%\DT_0004.tmp