Extracted

• • Target

    d38546e1c76cf5ad8c20a1bb04063011f8242da4fe227adb9289016162d6b355

  • Size

    1.5MB

  • MD5

    20189630d17250b2cca710af11437270

  • SHA1

    b74ae9a949650f511401127397c2343f110df12b

  • SHA256

    d38546e1c76cf5ad8c20a1bb04063011f8242da4fe227adb9289016162d6b355

  • SHA512

    74a9229e33419448c732f0e563744bffed9448ffaf1f451c6f46da12fc6917742d0be3ce24fefce7c3788bcfc6ce061bdfd00d377d0a533bd99e721f752405e6

  • SSDEEP

    24576:ce3i2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnj:NSTq24GjdGSgw+W7SCRnVQTEQ/BA8

  Score

  10^/10

  stealeriumcollectionspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2