Trojanized Macro Tool Drops BroPass and RedlineStealer on Chilean Targets

A Trojanized Macro Tool Conceals a Multi-Layer Credential Theft Operation Targeting Chile

A 32-kilobyte Windows executable masquerading as a macro encryption utility has become the delivery vehicle for one of the more technically deliberate credential-theft operations CTX Team has tracked against Chilean targets in recent memory. The outer wrapper — an NSIS installer named macro_encrypter.exe — drops at least two distinct stealer families onto victim machines while simultaneously executing a layered evasion stack that includes active sandbox detection, base64-encoded gzip payloads, non-Windows User-Agent C2 strings, and hardware-level victim fingerprinting. The campaign, attributed in the threat feed to Operation Spalax with an espionage motivation and a geographic scope limited to Chile, is not a commodity stealer deployment dressed up with a single obfuscation trick. The evasion investment across all three components — dropper, payload, and a separately distributed .NET-wrapped RedlineStealer variant — points toward an operator who expected analyst scrutiny and built the toolkit accordingly.

The three files at the centre of this operation were all first submitted to VirusTotal on 2022-05-21, sharing a PE compile timestamp of 2022-05-18 across two of the three samples. What they do not share is a common imphash, signer, or threat label: each component was compiled independently, and the only cohesion axis that binds the delivery wrapper to the stealer payload is a four-rule YARA fingerprint that fires identically on both — a binding that, as the analysis below shows, reveals more about the shared builder environment than any certificate chain or infrastructure cluster could.

The NSIS Wrapper: Productivity Lure With a High-Entropy Secret

The campaign's initial delivery vehicle is a 4,379-kilobyte PE32 NSIS installer (sha256: 824d80d047c5a33760850111677cf8f351dd2a7899df930500f83be03dae2844) that presents itself to the victim as macro_encrypter.exe, dropped into the %APPDATA% directory. The name is a deliberate social-engineering choice: macro encryption utilities occupy a plausible niche in enterprise and government environments where document security is a concern, and an executable with that label arriving through a phishing lure or a compromised software distribution channel [T1059] would attract less immediate suspicion than a file named after a known stealer family.

The installer's build provenance tells a different story. Its .rsrc section registers an entropy of 7.54 — well above the threshold that distinguishes compressed or encrypted embedded content from ordinary resource data — and the Cyren packer detection flags an additional obfuscation layer over the NSIS structure itself [T1027]. The spreader and overlay tags in the VirusTotal metadata confirm that the installer carries and drops embedded payloads rather than functioning as advertised. Imphash 56a78d55f3f7af51443e58e0ce2fb5f6 is unique to this file within the cluster, confirming it was compiled separately from its sibling components rather than repackaged from a shared binary.

Sandbox consensus on the NSIS dropper is 2/2 malicious: the C2AE sandbox returns a STEALER classification with a RedlineStealer family name at confidence 70, while the SecondWrite sandbox returns a more alarming triple classification — MALWARE, RANSOM, and TROJAN. The RANSOM label warrants attention. It may reflect a misclassification triggered by the encryption-themed filename and the high-entropy resource section, or it may indicate that the dropper carries a dual-use payload capable of ransomware behaviour alongside its primary credential-theft function. Current evidence cannot resolve this ambiguity: the SecondWrite verdict stands as an observation, not a confirmed capability. What can be confirmed is that 35 of 73 engines missed this file entirely at the time of first submission — a detection gap that reflects the effectiveness of the NSIS wrapper and the Cyren packing layer at the point of deployment.

Two YARA rules fire on the NSIS dropper that are directly relevant to its delivery mechanism. INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File (ditekSHen) confirms the presence of a base64-encoded gzip payload embedded within the executable body — a staged delivery pattern in which the outer installer decodes and decompresses the actual malicious payload at runtime rather than carrying it in plaintext form. INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA (ditekSHen) flags the presence of non-Windows User-Agent strings baked into the binary, indicating that the C2 communication logic embedded in the dropper itself — not just in the subsequently dropped stealer — is designed to transmit HTTP requests that do not identify the client as a Windows system [T1027.013]. This is a meaningful operational detail: proxy inspection rules and network monitoring tools tuned to flag anomalous Windows User-Agent strings will not catch traffic that presents as a Linux or macOS client.

The Four-Rule YARA Cohort: Evidence of a Shared Builder

The most structurally significant finding in this analysis is not any individual file's behaviour but the binding that connects the NSIS dropper to the BroPass stealer payload. All four YARA rules that fire on the dropper — sandboxdetect_misc (AlienVault Labs, "Sandbox detection tricks"), INDICATOR_SUSPICIOUS_References_SecTools (ditekSHen, "Detects executables referencing many IR and analysis tools"), INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File, and INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA — fire identically on the BroPass stealer (sha256: f32e33a2aee1b833d1e1c57b759a72b5bfdb47a14ef69776dccf8147b7dff5c5). The cohort size for each rule is exactly two, with the same pair of files as members.

The significance of this four-rule co-fire is that it is not coincidental overlap on a single broad detection. Each rule targets a distinct behavioural or structural property: sandbox evasion logic, IR-tool reference strings, embedded encoded payloads, and cross-platform C2 User-Agent strings. For all four to fire on both files simultaneously means the dropper and the stealer share the same embedded payload structure, the same analysis-tool reference strings, and the same C2 communication code. CTX Team's assessment is that this is consistent with a single builder environment or shared codebase rather than two independently developed tools that happen to share surface-level characteristics. The two files have distinct imphashes (56a78d55f3f7af51443e58e0ce2fb5f6 for the dropper, 9aebf3da4677af9275c461261e5abde3 for the stealer) and distinct vhashes, confirming separate compilation — but the YARA cohort establishes that the underlying code modules they draw from are the same.

This matters operationally because it means that a defender who detects and blocks the NSIS dropper on the basis of its YARA fingerprint has, in principle, the same detection surface for the BroPass stealer payload — even though the two files look entirely different at the binary level. The four-rule cohort is the campaign's most durable hunting signature precisely because it is not tied to a specific hash, packer, or certificate.

The BroPass Stealer: UPX at Maximum Entropy, Hardware Fingerprinting, and Self-Deletion

The BroPass/stealer component (sha256: f32e33a2aee1b833d1e1c57b759a72b5bfdb47a14ef69776dccf8147b7dff5c5) is a 4,124-kilobyte PE32+ 64-bit executable — the only 64-bit component in the cluster — packed with UPX at the maximum compression setting. Its UPX1 section registers an entropy of 8.0, the theoretical ceiling for compressed data, meaning that static analysis tools attempting to inspect the payload without first unpacking the UPX layer will encounter what is effectively random noise. The UPX0 section carries zero entropy, consistent with the standard UPX stub structure, and the UPX2 section at 2.07 entropy holds the minimal metadata the stub needs to reconstruct the payload at runtime [T1027].

The file's execution behaviour, as documented in the VirusTotal tag set, combines three distinct anti-forensic and anti-analysis capabilities. First, detect-debug-environment confirms active debugger detection logic [T1622] — the stealer checks whether it is running under a debugger before proceeding, a standard but effective technique for defeating dynamic analysis in controlled environments. Second, checks-network-adapters and direct-cpu-clock-access together constitute a hardware fingerprinting routine [T1497.003]: enumerating network adapters allows the stealer to detect virtual machine environments that present non-standard adapter configurations, while reading the CPU clock directly — bypassing the operating system's time API — is a timing-based sandbox evasion technique that detects the artificially accelerated clock speeds some sandbox environments use to compress execution time. Third, self-delete confirms that the stealer removes itself from disk after execution [T1070.004], eliminating the primary forensic artifact that incident responders would otherwise recover.

The combination of these three capabilities is operationally significant in a way that each individual technique is not. Hardware fingerprinting degrades sandbox fidelity by causing the stealer to behave differently in a virtual environment than on a real victim machine. Self-deletion then removes the binary from the endpoint before a human analyst can retrieve it for examination. The result is a tool that is specifically designed to be difficult to study — which in turn means that the detection signatures derived from static analysis of the binary are the most reliable hunting surface, since the runtime behaviour may be deliberately suppressed in controlled environments.

The BroPass stealer's primary function is browser credential harvesting. Its threat label (trojan.bropass/stealer) and popular names (bropass, stealer, infostealer) are consistent with a tool focused on extracting passwords, session cookies, and browser-stored credentials [T1555.003, T1539, T1552.001]. The MITRE technique set associated with this campaign also includes T1217 (browser information discovery), suggesting the stealer enumerates browser bookmark data in addition to stored credentials — a capability that can reveal internal network resources, web application dashboards, and authentication portals that the operator may subsequently target.

The BroPass sample's execution path places it at %APPDATA%\1891195180.exe (also observed at C:\Windows\SysWOW64\1891195180.exe), executed via Native API calls [T1106]. Two of three sandboxes return malicious verdicts — Dr.Web vxCube and DAS-Security Orcas both classify it as MALWARE — while the C2AE sandbox returns an UNKNOWN_VERDICT, a result that is itself consistent with the stealer's sandbox-detection logic having successfully identified the C2AE environment and suppressed its malicious behaviour during that analysis run. The industry detection ratio of 50/76 leaves 22 engines undetected, with notable misses including TrendMicro, TrendMicro-HouseCall, ClamAV, Malwarebytes, and CrowdStrike Falcon — a gap that is partially attributable to the UPX packing layer and the stripped external PDB that removes symbol information from the binary header.

The Snort IDS rule PROTOCOL-ICMP Unusual PING detected (severity medium, Snort registered user ruleset) fires on the BroPass sample alongside three lower-severity ICMP rules. This ICMP activity is consistent with host discovery or secondary C2 signalling behaviour — the stealer may be using ICMP echo requests to confirm network connectivity or to communicate with a C2 endpoint through a channel that bypasses HTTP-focused proxy inspection. The combination of the ICMP IDS hits with the INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA YARA rule suggests a multi-channel C2 approach: HTTP beaconing with non-Windows User-Agent strings as the primary channel, ICMP as a secondary or fallback mechanism.

The Microsoft Certificate Graft: A Stolen Chain on a .NET Wrapper

The third component in this cluster — the RedlineStealer dropper (sha256: 3c7b3da15d0f960c1d7d0dc50768fa8f60a3130cb008c99b467d3d4a2eadb25e) — is structurally isolated from the YARA cohort that binds the BroPass stealer and the NSIS dropper. It shares no YARA rule hits with its peers, carries a unique imphash (55be0c93c66ed8138f777cda7ce3ebbb), and presents a distinct threat label (trojan.lazy/msil) that identifies it as a .NET-wrapped variant rather than a native PE32+ or NSIS-packaged binary. Its popular names — lazy, msil, pandora — and its meaningful name string (%APPDATA%\@imkingtheporno_crypted.exe) together suggest a separately operated distribution channel, possibly a different operator handle within the same campaign infrastructure.

What makes this component analytically distinctive is its code-signing posture. The file carries a complete Microsoft code-signing certificate chain: leaf certificate issued to Microsoft Corporation, signed by Microsoft Code Signing PCA 2011, rooted at Microsoft Root Certificate Authority 2011. The leaf certificate serial number is 33 00 00 02 52 8B 33 AA F8 95 F3 39 DB 00 00 00 00 02 52, with thumbprint 8740DF4ACB749640AD318E4BE842F72EC651AD80. The chain's intermediate and root certificates are both valid — the Microsoft Code Signing PCA 2011 certificate runs from July 2011 to July 2026, and the root authority certificate runs from March 2011 to March 2036.

The leaf certificate, however, fails time-validity verification. Its validity window runs from 06:32 PM on 2021-09-02 to 06:32 PM on 2022-09-01, and the signing date recorded in the PE's Authenticode signature is 01:48 AM on 2021-12-03 — which falls within that window. The problem is the PE compile timestamp: 2022-05-18. A certificate that was signed on 2021-12-03 cannot have been legitimately issued for a binary compiled on 2022-05-18, because the signing event predates the binary's existence by nearly five months. The VirusTotal verdict is unambiguous: "The digital signature of the object did not verify." The file carries both the signed and invalid-signature tags simultaneously — the former reflecting the presence of a certificate chain, the latter reflecting the verification failure.

The operational interpretation is that the Microsoft certificate chain was either stolen from a legitimate Microsoft-signed binary and grafted onto this payload, or that the signing timestamp was manipulated to fall within the certificate's validity window while the binary itself was compiled later. Either scenario represents a deliberate attempt to exploit the trust that endpoint security products and enterprise allowlisting policies extend to Microsoft-signed binaries [T1027]. A security control that checks for the presence of a Microsoft certificate chain without also verifying the signing date against the PE compile timestamp would pass this file as legitimate.

The C2AE sandbox names this file RedlineStealer with a STEALER classification at confidence 70, consistent with the NSIS dropper's sandbox verdict. The detection ratio of 57/77 is the highest in the cluster, suggesting that the invalid-signature tag has triggered heuristic detections in engines that might otherwise have been deceived by the Microsoft chain. Engines still missing this file include TrendMicro, TrendMicro-HouseCall, and ClamAV — the same gaps visible across the BroPass stealer, suggesting a shared evasion surface that these engines have not yet addressed.

The .NET wrapper (MSIL threat label) adds a layer of obfuscation beyond the certificate graft. .NET binaries are more amenable to runtime code generation and reflection-based payload loading than native PE executables, and the trojan.lazy/msil label is consistent with a crypter or loader framework that decodes and executes the actual RedlineStealer payload in memory rather than writing it to disk [T1055]. The process injection techniques listed in the campaign's MITRE mapping — T1055, T1055.003 (thread execution hijacking), and T1055.012 (process hollowing) — are consistent with this interpretation, though no direct sandbox evidence of injection behaviour was observed for this specific file. These techniques are inferred from the RedlineStealer family's documented behaviour and the campaign's MITRE technique mapping.

The C2 Layer: An Unenriched IP and a Communication Pattern Built for Evasion

The network layer of this campaign remains the most significant gap in CTX Team's analysis. The sole network indicator is IP address 185.200.191.18, referenced as a potential C2 endpoint by one of the stealer samples. Using a bare IP directly as C2 with no domain layer leaves no certificate or registration trail, frustrating infrastructure tracking — the IP cannot be clustered with any of the three file IOCs through standard cohesion axes such as shared certificate serial, AS, or registrar. CTX Team's assessment is that this IP is a potential C2 endpoint, but confidence is low without further enrichment.

The absence of domain IOCs is equally significant. Operating entirely through a bare IP with no domain registration, DNS records, or certificate infrastructure leaves the C2 layer uncharted and difficult to pivot from — an architecture choice that frustrates infrastructure tracking as effectively as the endpoint evasion stack frustrates binary analysis. This has a direct operational consequence: defenders who block only the three file hashes will not disrupt active C2 beaconing from endpoints where the samples have already executed and self-deleted. The BroPass stealer's self-deletion behaviour [T1070.004] means that on a successfully compromised endpoint, the binary artifact is gone before incident response begins — leaving only network traffic and registry artifacts as recovery surfaces.

What the file-layer evidence does establish about the C2 communication pattern is worth examining in detail. The INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA YARA rule fires on both the NSIS dropper and the BroPass stealer, confirming that non-Windows User-Agent strings are embedded in both binaries' C2 communication code. This is not a runtime configuration loaded from a remote server — it is baked into the binary at build time, which means the operator made a deliberate architectural decision to use cross-platform User-Agent strings rather than the standard Windows browser agents that most proxy inspection rules are tuned to flag. The INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File rule confirms that the payloads transmitted over this C2 channel are base64-encoded and gzip-compressed, adding a data-encoding layer [T1027.013] that can defeat content-inspection rules looking for plaintext credential data in HTTP POST bodies.

The ICMP activity flagged by the Snort rule PROTOCOL-ICMP Unusual PING detected on the BroPass stealer introduces the possibility of a secondary C2 channel or a host-discovery phase that precedes the primary HTTP beaconing. ICMP-based C2 is a well-documented technique for bypassing firewall rules that permit ICMP traffic while blocking outbound HTTP on non-standard ports. The medium-severity classification of the "Unusual PING" rule — as opposed to the low-severity standard PING rules that also fire — suggests that the ICMP traffic pattern deviates from normal ping behaviour in a way the Snort ruleset considers suspicious, possibly in packet size, frequency, or payload content.

The registry interaction techniques in the MITRE mapping — T1012 (query registry) and T1112 (modify registry) — suggest the stealer components read system configuration from the registry during the discovery phase and may write persistence or configuration data back to it, though no specific registry keys were recovered. T1518 and T1518.001 (software discovery) indicate that the toolkit also enumerates installed software, consistent with RedlineStealer's documented behaviour of identifying installed browsers and credential stores before targeting them.

Operation Spalax and the Espionage Framing: What the Evidence Confirms and What It Does Not

The threat feed attributes this activity to Operation Spalax, with motivations listed as espionage and a geographic scope of Chile. CTX Team treats the attribution and motivation tags as the primary framing for this campaign. No public reference excerpts were available, and the actor's state alignment, sponsorship, and prior campaign history cannot be confirmed — those claims are omitted here rather than inferred from background knowledge.

What the evidence does confirm is the geographic and motivational framing: the campaign is scoped to Chilean targets, and the operator's objective — as indicated by the credential-theft focus of both RedlineStealer and BroPass — is the collection of browser-stored passwords, session cookies, and authentication tokens [T1555.003, T1539] rather than financial fraud. The browser bookmark discovery technique [T1217] adds an intelligence-collection dimension: an operator interested in espionage would use bookmark data to map the victim's internal network resources, web application access, and organisational relationships before proceeding to lateral movement or data exfiltration.

No specific sector can be confirmed as the primary target. The browser-credential focus of the toolkit makes any organisation that relies on browser-stored credentials a plausible target — which in practice means government agencies, financial institutions, and enterprise environments with browser-based access to internal systems are all within the plausible target profile. The espionage motivation tag, combined with the Chilean geographic scope, is consistent with an operator interested in government or policy-relevant targets, but this is an inference from the motivation label rather than a finding grounded in victim data.

The meaningful name string @imkingtheporno_crypted.exe on the isolated RedlineStealer variant is an operational detail that warrants a brief note. Strings of this form — combining a social-media-style handle with the word "crypted" — are characteristic of the underground crypter market, where operators pay crypter services to wrap their payloads in obfuscation layers that evade specific AV engines. The @imkingtheporno prefix may be the crypter operator's handle rather than the campaign operator's, which would mean the RedlineStealer component was sourced from a third-party crypter service rather than built in-house. This is consistent with the file's isolation from the YARA cohort that binds the NSIS dropper and the BroPass stealer: if the dropper and stealer were built from a shared codebase, and the RedlineStealer variant was sourced separately from a crypter service, the two distribution channels would naturally produce files with different YARA fingerprints.

Evasion as a Design Principle: What This Toolkit Signals About Operational Maturity

The most analytically significant aspect of this campaign is not any individual technique but the cumulative investment in analyst resistance across all three components. Taken individually, each evasion mechanism — UPX packing, sandbox detection, self-deletion, a grafted certificate chain — is a commodity technique available in any underground toolkit. Taken together, across three separately compiled components that share a common YARA fingerprint, they describe an operator who approached the toolkit's construction with a specific threat model in mind: the threat of detection and analysis by endpoint security products, sandbox environments, and human analysts.

The NSIS dropper achieved only 32/73 detections at first submission, with 35 engines still missing it — a detection gap that reflects the effectiveness of the NSIS wrapper, the Cyren packing layer, and the high-entropy .rsrc section at the point of deployment. The BroPass stealer's self-deletion behaviour means that on a successfully compromised endpoint, the binary is gone before incident response begins. The RedlineStealer variant's invalid Microsoft certificate chain is designed to pass trust-based endpoint controls that check for the presence of a Microsoft signature without verifying the signing date against the PE compile timestamp. Each of these evasion investments targets a different layer of the defensive stack: static detection, dynamic analysis, and trust-based allowlisting.

The four-rule YARA cohort that binds the dropper and the stealer is the campaign's most significant analytical artifact precisely because it is the one fingerprint the operator did not successfully suppress. The shared sandbox-detection logic, IR-tool reference strings, embedded encoded payloads, and non-Windows User-Agent strings that the four rules detect are structural properties of the shared builder environment — not runtime behaviours that can be suppressed by sandbox-detection logic. An operator who invested this heavily in runtime evasion left a static fingerprint in the build toolchain that persists across separately compiled binaries.

The bare C2 IP 185.200.191.18 with no domain layer leaves the network layer of this campaign open for continued operation. The operator's decision to use non-Windows User-Agent strings and base64/gzip-encoded C2 payloads — both baked into the binary at build time rather than loaded from a remote configuration — suggests a deliberate effort to evade network-layer inspection that is as considered as the endpoint evasion stack. The ICMP secondary channel adds a further layer of network-layer resilience. An operation that has invested this much in both endpoint and network evasion, and that is attributed to an espionage-motivated actor with a specific geographic focus on Chile, is unlikely to be a one-time deployment. The toolkit's architecture — multiple parallel distribution channels, a shared builder environment, and a C2 layer that remains entirely uncharted — is consistent with an operator who intends to continue operating and who has structured the campaign to survive partial exposure.

The sector that will feel this shift most directly is any Chilean organisation that has not yet moved beyond browser-stored credential management for access to sensitive internal systems. The combination of RedlineStealer's browser-credential harvesting [T1555.003] and BroPass's session-cookie theft [T1539] means that multi-factor authentication schemes that rely on session persistence — rather than per-request authentication — are within the toolkit's effective reach. An operator with espionage motivations and access to a harvested session cookie for a government or financial web application does not need the victim's password: the session token is sufficient for access until it expires or is revoked. That operational reality, more than any individual technique in this toolkit, is what makes the campaign's credential-theft focus consequential for the organisations within its geographic scope.