An In-Depth Look at Scarface Stealer

Overview

This week, the SonicWall Capture Labs Threat Research team analyzed a sample of ScarfaceStealer, a Go-compiled information stealer that utilizes sophisticated anti-analysis techniques including:

1. Heavy String Obfuscation - Uses space/rocket-themed junk strings to evade detection
2. Function Name Obfuscation - Main functions use randomly concatenated English words
3. Go Embed Package - Embeds configuration/payloads within the binary
4. Minimal Visible Strings - Only 47 strings visible through Ghidra's string analysis

Technical Overview and Infection Cycle

Initial detection shows an unknown file type, but sections and section data show that the file is a Golang binary. The timestamps have also been tampered with to show a compile time of 1969. 

The file is heavily obfuscated with both function calls and strings. During runtime, these do not decode or rename themselves.

At runtime, the following is executed:

Phase 1: Initialization

1. main.Introducing - Initializes malware components
2. main.Impossible - Performs anti-VM/sandbox checks
3. main.Existence - Checks for existing infections

Phase 2: Target Identification

1. main.Identifying - Fingerprints the system
2. main.Selecting - Identifies valuable targets (browsers, wallets)

Phase 3: Data Collection

1. main.Solutions - Core stealing functionality
2. main.Microphone - Audio capture
3. main.Thumbnails - Screenshot capture
4. main.Demonstrate - Extensive data gathering

Phase 4: Staging

1. main.Preparing - Stages collected data
2. main.Allowance - Manages resource allocation

Phase 5: Exfiltration

1. main.Coordinate - Coordinates with C2
2. main.Descending - Exfiltrates data

LAUNCH_COMMAND, trajectory_calibration, TELEMETRY, orbital_insertion, IGNITION, HANDSHAKE_COMPLETE, MISSION_ABORT, FUEL_SYSTEM_NOMINAL
Stage1, Stage2, Stage3, prelaunch, countdown, liftoff
ALPHA_ZULU, BRAVO_TANGO, GPS-Galileo-GLONASS
trajectory_optimization_score, gravitational_alignment_value
quaternary_stabilization_node, quantum_entanglement

Configuration and payloads may be embedded within the binary using Go's embed package.

Imported DLLs and Capabilities

DLL Dependencies

Key Windows API Functions

File Operations

• CreateFileW, DeleteFileW, MoveFileW
• ReadFile, WriteFile, SetEndOfFile
• GetFileAttributesW, SetFileAttributesW
• GetTempPathW, GetCurrentDirectoryW
• FindClose, CreateFileMappingW

Process/Thread Operations

• CreateThread, CreateProcessAsUserW
• OpenProcess, ExitProcess
• GetCurrentProcessId, GetExitCodeProcess
• TerminateProcess, WaitForSingleObject

Memory Management

• VirtualAlloc, VirtualFree, VirtualQuery, VirtualLock
• LocalAlloc, LocalFree

Registry Operations

• RegCloseKey, RegCreateKeyExW
• RegQueryValueExW, RegQueryInfoKeyW
• RegLoadMUIStringW, RegDeleteValueW

Network Operations

• WSAStartup, WSACleanup, WSAIoctl
• WSARecvFrom, WSASendTo
• closesocket, getsockname, getpeername
• getsockopt, setsockopt
• DnsQuery_W, DnsRecordListFree
• GetAddrInfoW, TransmitFile, AcceptEx

Cryptographic Operations

• CryptAcquireContextW, CryptReleaseContext
• CertOpenSystemStoreW, CertGetCertificateChain

Security/Authentication

• GetTokenInformation, LookupAccountSidW
• LookupAccountNameW, ConvertSidToStringSidW
• ConvertStringSidToSidW, GetLengthSid

Readable Main Functions

The following exported functions likely contain the core malware logic:

Suspected Capabilities

Based on code analysis, this stealer likely targets:

Browser Data

• Cookies
• Saved passwords (Login Data)
• Browser history
• Autofill data

System Information

• Hardware fingerprinting
• Network configuration
• User account details
• Installed software

Communication

• Uses net/http for HTTP communications
• TLS support (crypto/tls, crypto/x509)
• DNS operations for domain resolution

Audio Capture

• main.Microphone function suggests audio recording capability

Screen Capture

• main.Thumbnails function suggests screenshot capability

The following ciphers are referenced throughout the file:

MITRE ATT&CK Mapping

Conclusion

This ScarfaceStealer sample represents a moderately sophisticated Go-based information stealer that employs creative obfuscation techniques to evade detection and hinder analysis. The space/rocket mission themed strings are a unique fingerprint of this malware family. The use of Go provides cross-platform potential while complicating reverse engineering due to Go's unique calling conventions and runtime. The embedded configuration via Go's embed package suggests the malware may be easily repackaged with different C2 configurations.

Sonicwall Protection

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: ScarfaceStealer.Rocket (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™ and the Capture Client endpoint solution.

IOCs

34bf38875030dbee3e231dcfd05505fae829475e68dd2db2f0ec204593cd3212