General

  • Target

    config.exe

  • Size

    1.6MB

  • Sample

    240218-xjle8sdg7v

  • MD5

    808efb233464b44feb4dddf45e8b5609

  • SHA1

    6ffcbad03c576f1d36578917158329083c49e89d

  • SHA256

    d3ae446d03ddb2833c6bb8649ef0705d3f061f3d35ed2c387e4177f2fc02942b

  • SHA512

    42ee94b04a057e442d78b5b525eb73627951bf48cdf269b23e7f8ad53d97920d64ee519242c03a27b3d00d83a8c66753c386c21bf5d4f5d629b168427dd79506

  • SSDEEP

    49152:dkTq24GjdGSiqkqXfd+/9AqYanieKdsp:d1EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1207428965619339275/8grsUTWBqcb1NqwTGm7HMQvlt9JQl50zXjUGjVBdPIFj85OhdOd7rUgGxcXp03_OFLi5

Targets

    • Target

      config.exe

    • Size

      1.6MB

    • MD5

      808efb233464b44feb4dddf45e8b5609

    • SHA1

      6ffcbad03c576f1d36578917158329083c49e89d

    • SHA256

      d3ae446d03ddb2833c6bb8649ef0705d3f061f3d35ed2c387e4177f2fc02942b

    • SHA512

      42ee94b04a057e442d78b5b525eb73627951bf48cdf269b23e7f8ad53d97920d64ee519242c03a27b3d00d83a8c66753c386c21bf5d4f5d629b168427dd79506

    • SSDEEP

      49152:dkTq24GjdGSiqkqXfd+/9AqYanieKdsp:d1EjdGSiqkqXf0FLYW

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks