Extracted

• • Target

    6a78bd0e44ac25cf4472a4b5da44b3b0.exe

  • Size

    517KB

  • MD5

    6a78bd0e44ac25cf4472a4b5da44b3b0

  • SHA1

    c432433cda71522abebe78989ad773743dfb4d7b

  • SHA256

    8711fffca6194b39a981b40f0db1225992ab3f96823a2cbe61c6547490b5abcb

  • SHA512

    e00ea80e72e4051b6977246727f74f4951efea575eb2142d58b4fc06a2ada886ba0980e76cdde4c38560192c8b290dcfdf633ef70964e3a7abe4951aefb559fd

  • SSDEEP

    12288:3g5G3DW7oEKY8AZF1+THsPXF3L2LY5ZKhbQvpM2gv1aXlA/Z0BaxL2o:3RTW7oEKY840H

  Score

  10^/10

  icarusstealerpersistencestealer

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2