icarusstealer | d3544b079602557b6633eeba817ba5131d7069a5be7bd6b22dfdafee844512dc | Triage

Sharing

General

Target

f88253a.exe
Size

783KB
Sample

230824-tdyxlafb91
MD5

e1b571f44d4761081c56d29467bac4f7
SHA1

37f8c4277fc57eb3fed752f25e90df05eefaaca5
SHA256

d3544b079602557b6633eeba817ba5131d7069a5be7bd6b22dfdafee844512dc
SHA512

77ade273ad61a7db2cbf9441d9a2288aa44470f155c50ab3e95b8562a2f6a9980fcf8a5e41b97259b7eddbe7b1be8f8926ee35f8e62d4766d6d8054f7fb89914
SSDEEP

12288:6KiRFtly8DLSbHx7c2s/ckj33aXehQvzGP7n1P6+Zecb:6KeygWBHs0k7r71P6+Zes

Score

10^/10

icarusstealer evasion persistence stealer trojan

Malware Config

Extracted

Family

icarusstealer

C2

192.168.1.106

Attributes

payload_url
https://blackhatsec.org/add.jpg
https://blackhatsec.org/remove.jpg
https://raw.githubusercontent.com/GodOfWareFare/TheGoodKidPhotos/main/rt.jpg

Targets

- Target
  
  f88253a.exe
- Size
  
  783KB
- MD5
  
  e1b571f44d4761081c56d29467bac4f7
- SHA1
  
  37f8c4277fc57eb3fed752f25e90df05eefaaca5
- SHA256
  
  d3544b079602557b6633eeba817ba5131d7069a5be7bd6b22dfdafee844512dc
- SHA512
  
  77ade273ad61a7db2cbf9441d9a2288aa44470f155c50ab3e95b8562a2f6a9980fcf8a5e41b97259b7eddbe7b1be8f8926ee35f8e62d4766d6d8054f7fb89914
- SSDEEP
  
  12288:6KiRFtly8DLSbHx7c2s/ckj33aXehQvzGP7n1P6+Zecb:6KeygWBHs0k7r71P6+Zes
Score

10^/10

icarusstealer evasion persistence stealer trojan
- IcarusStealer
  Icarus is a modular stealer written in C# First adverts in July 2022.
  stealer icarusstealer
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

icarusstealerevasionpersistencestealertrojan