Analysis of a new Stealc loader disguised as a fake "GPT/Claude Free" app

Just spent the last few hours reversing a sample that's being distributed as a fake offline Claude / GPT desktop client. The binary I got was named GPT_Claude_Free.exe (though it also bundles a Russian video editor decoy to keep up the facade).

Under the hood, it's a 3-stage custom crypter delivering a Stealc v2 payload. Here's a quick dump of how the packer works and what the payload is doing.

Reversing the loader: First thing it does is run through a bunch of anti-analysis checks. It calls IsDebuggerPresent, checks NtGlobalFlag manually from the PEB (via gs:[0x60]), and queries registry keys for VM stuff (VMware/VirtualBox). There's also a timing loop that spins a custom LCG generator 100k times to mess with basic dynamic analysis.

If it passes, it moves to the decryption logic. The payload is tucked away in the .xdata section. It's stored entirely as printable ASCII. It runs through three distinct phases:

1. Base85 decode: It uses a custom alphabet translation table at offset 0x4073A0 (in .rdata).
2. Rolling XOR: Decrypted stream is XOR'd with a 32-byte key at 0x406040 (72d57da187da5de93942e1ae1b9dcf20ee2a00f5ff979cb7d5e1a8e79a46584c).
3. AES-256-CBC: The key is at 0x406010 (f20daa63a36905e004390c7fc79c79dc73a290b3330868fdad63cbe16a7974d3) and the IV is at 0x406030 (4e6279de852509f8ce25c6357718ccd2).

Once it has the clean MZ PE in memory, it doesn't write anything to disk. It just performs process hollowing (standard NtAllocateVirtualMemory / relocation adjustments) to inject it directly.

Reversing the payload: The decrypted binary is Stealc v2. If you look at the configuration block (stored inside the .stgcfg section starting with 'CGTS' magic bytes), it's set up to steal basically everything:

• Browsers: Targets credentials, autofill, credit cards, and session cookies from ~30 Chrome/Firefox derivatives.
• Wallets: Grabs MetaMask/TokenPocket extension folders and desktop wallet files (Exodus, Electrum, Monero, Coinomi).
• Tokens: Scans Local Storage folders for Discord tokens and grabs Telegram tdata directories.
• Gaming/VPN: Steam, Battle.net, GOG, WinSCP, FileZilla, and OpenVPN configurations.
• Recon: Captures clipboard & screenshots.

It exfiltrates everything via POST requests to the C2 using HTTP headers like X-Gate-Token and X-Build-ID.

Decrypted payload hash for anyone who wants to write rules or pivot: 1f498b81fd767687f72605e18628fb6b6ba40035325fb6618d519ae88d7a27c2

Let me know if you run into this family or if you want me to share the decompiled extraction script.