Extracted

• • Target

    teset.exe

  • Size

    690.0MB

  • MD5

    359d0c3424b46b9947f63aac496ccd48

  • SHA1

    79dec290fdf8c12e3949321e8df5bcaf7ccc1d18

  • SHA256

    359ad5a8f9bf0c74f4963db5bd5d81c31576f78e4e2e631409f3700821ed7f43

  • SHA512

    f0ac2b6c0fdff47562c97007311ef91b71279e52de83312789973d5183f285a007654da341c21b3c0697909092b34d8ee00c03a30d58f51e813aa3b2e9e9b8e7

  • SSDEEP

    12288:rmJUQBuLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+Qh:4BZ6N6LqQzJqkW

  Score

  10^/10

  icarusstealerpersistencestealer

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer

  • Modifies Installed Components in the registry

    persistence

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2