Python InfoStealer With Dynamic Sandbox Detection, (Tue, Feb 20th)

Category :

SANS Full Feed

Posted On :

Infostealers written in Python are not new. They also onboard a lot of sandbox detection mechanisms to prevent being executed (and probably detected) by automatic analysis. Last week, I found one that uses the same approach but in a different way. Usually, the scripts have a list of “bad stuff” to check like MAC addresses, usernames, processes, etc. These are common ways to detect simple sandboxes that are not well-hardened. This time, the “IOD” (Indicators Of Detection) list is stored online on a Pastebin-like site, allowing the indicators to be updated for all scripts already deployed. It’s also a way to disclose less interesting information in the script.

The file, called, has a VT score of 22/61 (SHA256: e0f6dcf43e19d3ff5d2c19abced7ddc2e703e4083fbdebce5a7d44a4395d7d06)[1]

The script will fetch indicators from many files hosted on[2]:

remnux@remnux:/MalwareZoo/20240217$ grep hxxps://rentry[.]co
processl = requests.get(“hxxps://rentry[.]co/x6g3is75/raw”).text
mac_list = requests.get(“hxxps://rentry[.]co/ty8exwnb/raw”).text
vm_name = requests.get(“hxxps://rentry[.]co/3wr3rpme/raw”).text
vmusername = requests.get(“hxxps://rentry[.]co/bnbaac2d/raw”).text
hwid_vm = requests.get(“hxxps://rentry[.]co/fnimmyya/raw”).text
gpulist = requests.get(“hxxps://rentry[.]co/povewdm6/raw”).text
ip_list = requests.get(“hxxps://rentry[.]co/hikbicky/raw”).text
guid_pc = requests.get(“hxxps://rentry[.]co/882rg6dc/raw”).text
bios_guid = requests.get(“hxxps://rentry[.]co/hxtfvkvq/raw”).text
baseboard_guid = requests.get(“hxxps://rentry[.]co/rkf2g4oo/raw”).text
serial_disk = requests.get(“hxxps://rentry[.]co/rct2f8fc/raw”).text

All files were published on January 27 2024 around 23:19 UTC. The website gives also the number of views. Currently, there are only two (certainly my visits) so the script hasn’t been released in the wild yet. I’ll keep an eye on these counters in the coming days.

Here is an example of usage:

def checkgpu(self):
c = wmi.WMI()
for gpu in c.Win32_DisplayConfiguration():
GPUm = gpu.Description.strip()
gpulist = requests.get(“”).text
if GPUm in gpulist:

The remaining part of the stealer is very classic. I just extracted the list of targeted websites (cookies are collected and exfiltrated):

keyword = [

You can see that classic sites are targeted but generic keywords are also present like “crypto”, “bank” or “card”. Cookies belonging to URLs containing these keywords will also be exfiltrated.


Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.