unclassified-msvc-browser-credential-harvester

MSVC 14.50 x64 DLL browser credential harvester with Chrome App-Bound Encryption (ABE) bypass. Single export Bootstrap. No packing, no obfuscation, no Authenticode. Statically links SQLite 3.49.1. No network IAT — writes harvested data to local JSON files for companion exfiltration stage.

Build / RE

• Language: C++ (MSVC 14.50, Visual Studio 2022)
• Format: PE32+ x64 DLL, Windows GUI subsystem
• Packing: None
• Obfuscation: None
• Anti-analysis: Minimal (IsDebuggerPresent, QueryPerformanceCounter timing, CreateMutexW single-instance)
• Signing: Unsigned
• GuardCF: Enabled (unusual for malware)
• POGO: Profile-Guided Optimization debug directory present
• SQLite: 3.49.1 statically linked (source ID 873d4e274b...)
• Export: Bootstrap @ 0x18002FA88 with embedded PEB-walking API resolution stub

Deploy / ATT&CK

• T1555.003 — Credentials from Password Stores: Browser (Chrome, Brave, Edge, Firefox)
• T1552.004 — Private Keys (Chrome App-Bound Encryption bypass)
• T1082 — System Information Discovery (RtlGetVersion, GetUserNameA, GetComputerNameA)
• T1057 — Process Discovery (CreateToolhelp32Snapshot)
• T1622 — Debugger Evasion (IsDebuggerPresent)
• T1497.001 — Time-Based Evasion (QueryPerformanceCounter, GetTickCount)
• T1055 — Process Injection (DLL form + Bootstrap export with reflective loader pattern)

Capabilities

• chrome-app-bound-encryption-bypass — decrypts app_bound_encrypted_key with ABE, falls back to legacy DPAPI
• browser-credential-harvesting — cookies, passwords, saved cards, IBANs, OAuth tokens via SQLite
• sqlite-local-credential-store — statically linked SQLite 3.49.1 for in-process database queries
• bcrypt-aes-key-management — BCryptOpenAlgorithmProvider, BCryptGenerateSymmetricKey, BCryptDecrypt
• dpapi-com-interop — CoInitializeEx + CoCreateInstance for DPAPI CryptUnprotectData
• peb-walking-api-resolution — Bootstrap export contains ROR13 export hash resolution stub
• json-fingerprint-staging — writes fingerprint.json, cookies.json, passwords.json, etc.
• single-instance-mutex-gating — CreateMutexW + WaitForSingleObject
• guardcf-camouflage — Control Flow Guard enabled for legitimate-software masquerade

Known Samples

Related

• browser-credential-harvesting — cross-family concept
• chrome-app-bound-encryption-bypass — technique page for ABE bypass
• peb-walking-api-resolution — technique page for the Bootstrap export stub
• stealc — commodity C++ infostealer with similar build stack but different capabilities (keylogging, named pipes, WINHTTP C2)
• chromeloader-pulsar-rat — .NET RAT with chrome_decrypt.dll module but different build stack