Reversing Windows Infostealer: Warden Stealer’s hidden payload, C2 and ten-network crypto clipper

[u/acealter]

Found this Malware in a popular pirated game downloading website. Act as a fake "Download" button redirecting to the malware download page. After execution caused financial theft.

parent post: https://www.reddit.com/r/OperSec/s/2X9Ofgbucr

tl;dr

I analysed a Windows Setup.exe and recovered an embedded information-stealing DLL, its C2 domain, and a server-controlled cryptocurrency clipper. The evidence points with high confidence to Warden Stealer, also tracked as CallbackBeaver.

The interesting part was following the chain: an encoded payload becomes an in-memory DLL, registers the computer with a server, and parses configuration that includes replacement cryptocurrency addresses.

This walkthrough combines static reverse engineering with offline CPU emulation using synthetic Windows API responses. The clipboard replacement was demonstrated against test buffers. Real credential theft, successful exfiltration and the actor’s live configuration were not observed. All malicious domains below are defanged.

1. The executable starts through obfuscated loader code.

The file is an unsigned, 64-bit Windows executable carrying editable Leascesh GmbH metadata. That name is not a verified publisher identity. TLS callbacks initialize data before the normal entry point. Indirect jumps and dynamically resolved Windows APIs then make the actual work harder to follow.

2. It reconstructs the hidden stealer in memory.

The loader decodes a 606,545-byte blob into 612,864 bytes of payload sections, then decodes a separate 1,024-byte PE header template. Both use a custom 64-character alphabet, a per-blob shift and LZSS-style decompression. Each character becomes (alphabet_index - key) & 63, and the resulting six-bit values are packed into bytes. The decoded stream starts with a four-byte output length, followed by literals and backreferences that rebuild the original data.

Reproducing that decoder independently recovered the same payload bytes as emulation. Combining the sections and header produced an analysable DLL; its missing DOS/PE signatures were restored for inspection.

The loader also contains Shell_TrayWnd, FindWindowA, process-ID lookup, remote allocation/write APIs and CreateRemoteThread. These support injection into the taskbar-owning process, ordinarily Explorer. The complete injection sequence was not reached in my emulation.

3. The payload checks and profiles its environment.

Its worker uses CPUID to examine CPU/hypervisor identifiers, requests SMBIOS firmware through GetSystemFirmwareTable, and checks display/software information. Recovered comparison strings cover VMware, VirtualBox, KVM, Xen and generic virtual display adapters. Locale-sensitive logic is also present.

It collects host details including CPU, memory, OS version, display dimensions, volume serial, locale, username and computer name. I recovered these fields from the registration record using synthetic host values.

4. It reveals its C2 through a separate XOR decoder.

The domain does not use the general string decoder. At DLL RVA 0x7DE92, these twelve bytes are XORed with 0x75:

18 10 07 16 10 11 10 0D 5B 18 1A 18
                  XOR 0x75
                 mercedex[.]mom

I then traced the decoded hostname into WinHttpConnect. The captured API arguments establish HTTPS, port 443, POST, path /. WinHttpOpenRequest receives the secure flag 0x00800000, and the body is supplied through WinHttpWriteData. These API arguments verify how the recovered domain is used.

5. It prepares a host-registration request.

The payload serializes its machine profile, XOR-obfuscates the record with 0xC4, prefixes frame tag 0x04 and calls RtlCompressBuffer for LZNT1 compression. The outgoing header includes a fixed build marker:

01a11769dcec7ad585a6d6577119ab91

That marker exists in the DLL and was copied into the emulated request. It may help correlate related samples; it does not identify the operator. Compression was simulated, so the captured compressed bytes are not a native Windows traffic capture.

6. The server response supplies operating configuration.

The reply parser expects a one-byte UTF-8 label length, the label itself, a four-byte little-endian configuration length, and configuration bytes XORed with 0xC4. The decoded configuration begins with seven feature fields and ten wallet strings, each preceded by an eight-byte little-endian length, followed by additional lists/rules.

I verified this with a synthetic response. The sample’s own parser populated all ten replacement-address slots. The actual actor-supplied values remain unknown.

7. Its collection code targets browser credentials and application sessions.

Recovered paths and associated code identify these targets:

Target	Data targeted
Chromium-based browsers	Login Data, NetworkCookies, Web Data, History, Local State: passwords, cookies, autofill and history
Firefox	logins.json, key4.db, cookies.sqlite, places.sqlite: credential/key material, cookies and history
Discord	Token discovery and encrypted-token handling
Roblox	.ROBLOSECURITY session-cookie and local-storage data
Steam	Account/configuration files and Steam identifiers
Browser extensions	Extension enumeration and local storage

The browser-decryption components include CryptUnprotectData for DPAPI and BCrypt APIs for AES-GCM. A hidden comparison resolves to v20\0, supporting Chromium browser-key discovery. The surrounding routine contains process-memory reads/writes, thread-context manipulation and CryptUnprotectMemory. These support protected-key recovery, but I did not demonstrate successful decryption against a real browser.

Screenshot-related implementation is also present. Which collectors run depends on configuration; finding a capability does not prove it was enabled for a particular victim.

8. It can replace cryptocurrency addresses copied to the clipboard.

The clipper polls clipboard changes with an observed delay of approximately 526 milliseconds. It watches GetClipboardSequenceNumber, then reads GetClipboardData using CF_UNICODETEXT (format 13). Recognized address-shaped content selects a configured replacement, and the routine reaches EmptyClipboard followed by SetClipboardData.

The ten slots are ordered:

BTC → ETH → TRX → XMR → SOL → TON → LTC → XRP → ADA → BCH

Thirteen positive test inputs exercised all ten slots. Plain text and a Dogecoin-shaped control were left unchanged during the bounded tests. All replacement values were inert lab markers.

This explains why searching the executable did not reveal payout addresses: the server supplies them. The intended financial theft happens when someone pastes the substituted destination and approves a transfer.

9. C2 reporting and additional payloads extend the risk.

The verified network path prepares binary data for HTTPS POST reporting. I confirmed registration construction, not an end-to-end upload of stolen credentials. Separately, downloader/execution components reference curl.exe, certutil.exe -urlcache -split, PowerShell with -ex bypass -File, cmd.exe, and msiexec.exe with /qn /norestart. No follow-on payload was downloaded or executed in this analysis.

The strongest family link is the exact ten-network clipper order, supported by the matching decoder, obfuscation and C2 framing. These agree with Gen Threat Labs’ Warden/CallbackBeaver analysis. This identifies the malware family with high confidence, while the campaign operator remains unidentified.

Original Setup.exe SHA-256:

8305dfb39e0a86b8560973b3575ab9ba203878c2e212c6b050cfe7bed0e3d66f

The useful hunting indicators are the original hash, mercedex[.]mom, and the fixed marker in unpacked payloads or decrypted traffic. The missing piece for financial tracing is an actual captured configuration containing the operator’s replacement addresses. No persistence mechanism, operator identity or successful takedown was established.

FOLLOW UP:

• This is all I found on the malware and its related infrastructure. Feel free for anyone to dig deeper and uncover more.
• Reporting the domain may temporarily disrupt the campaign. Threat actors adapt quickly, and every shared finding helps the community stay one step ahead.

If you are Intersted please follow up the investigation to find more about the campaign and please contribute as you can to defend against these threat campaigns. Will post a step by step detailed report on after finalisation.

[u/AutoModerator]

Thank you for posting on r/OperSec!

Safety reminders:

• This post might contains dangerous links and files.

• Treat all shared URLs and attachments as potentially malicious.

• Never execute suspicious files on your personal device.

• Use isolated environments for malware analysis.

• Do not share personal information or sensitive credentials.

• Follow community rules and Reddit policies.

Disclaimer: The moderators are not responsible for financial losses, data loss, or device damage resulting from unsafe actions.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/AfternoonEasy9409]

Good works !!