Overview

overview

10

Static

static

CHEESE.exe

windows7-x64

10

CHEESE.exe

windows10-2004-x64

10

Resubmissions

14-10-2022 06:08

221014-gwce4abbe6 7

14-10-2022 06:00

221014-gqlrksahdk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CHEESE.bin.zip

  • Size

    631KB

  • Sample

    221014-gqlrksahdk

  • MD5

    111d73d912103869d8ee8971c3ebc0a6

  • SHA1

    00e3e1055b6dd9e56157c3afe3ce94c8bdb6762a

  • SHA256

    12f14e1af4c6952b968d05f51c08dd1b9e170d072aee4fd073510c55d54eba27

  • SHA512

    d88791b0e2210684cbcb8098fb75c0590f8efdb4b66141f1bcb7580174b29a963c7b99836253c3ab29609b329aa2551e3a08decae23a10baecb31244f390ea2d

  • SSDEEP

    12288:pHeKEBuS+Eanvu3kfxye5MPiic7g4qdMpyHzwMQ51mVC6v+VqisVIILKir6Syx:p+Kujranvu3kfx/hic+LMpm6sfnY

Score
10/10
erbiumstealer

Malware Config

Extracted

Family

erbium

C2

http://77.73.133.53/cloud/index.php

Targets

    • Target

      CHEESE.bin

    • Size

      2.4MB

    • MD5

      12ef571baf523c098fc4e96bb3759c21

    • SHA1

      b476dd2bed415fbbc9c96e4a33160d12bf8413bb

    • SHA256

      2180293a0c0b7340f85543d453c10e8f9a059b69a530428fe1858e92a7fa63c3

    • SHA512

      e4e2354ee21ede5f3a61c00ac9766736e55e23bd3577b5bc41a7f493b8143159ca8d771fad7af4ee4b7fd56be450b82651f0ce87b82e873119e9f1655ac7249a

    • SSDEEP

      24576:DYof7x+kxP2gEDiYbYXQZCsuMUTSyzdvi1ucvgDfR1JJMK3LTiF+cTl3RuQ5531C:kozx+kxugEaYu1JJMK3n/al3Q

    Score
    10/10
    erbiumstealer

    • Erbium

      Erbium is an infostealer written in C++ and first seen in July 2022.

      stealererbium

    • Downloads MZ/PE file

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks