Extracted

• • Target

    Lol.exe

  • Size

    494KB

  • MD5

    c0e9809fcc4b0347e9257a16d71eeecb

  • SHA1

    45dd5e7f29e2939de5fb6bd7efe1cf59b6170dd7

  • SHA256

    723eff54d04dabd806c06190b582ccaba96836d923ce2d49fef537ba3568669a

  • SHA512

    a24ee93e7978f5075fed12c04e1100e94123df5f11c7e4e81821ac929a411e0a39b86248d1fb6bd89e09cb8835351cd2e06911041aea1c8ba34c75d274a21ba6

  • SSDEEP

    12288:uX4axuLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+Qq:uX5/6N6LqQzJqkd

  Score

  10^/10

  icarusstealerpersistencestealer

  • IcarusStealer

    Icarus is a modular stealer written in C# First adverts in July 2022.

    stealericarusstealer

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2