Overview

overview

10

Static

static

10

build.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    build.exe

  • Size

    1.6MB

  • Sample

    240426-bmtecsgh29

  • MD5

    74a170d28a087906ca88927e4a3085dd

  • SHA1

    552b487b32c9c0e5fbb4059c489319d765a63fd0

  • SHA256

    9b51049778d3a3805983eeee1fe35d3945d8298857de0ae57e1885ee63e594da

  • SHA512

    381e260dce7cef7adb2d6caeeea46866ac78c547278e8b7518fcc3df6c2bdd0c6b51fa7d4b4d6ee0715b247e3df5180c22c5bb17c46f21d2366b65319bcced91

  • SSDEEP

    49152:tcTq24GjdGSiqkqXfd+/9AqYanieKdYF:t9EjdGSiqkqXf0FLYW

Score
10/10
stealeriumcollectionspywarestealer

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1233216610601275393/giRllHnPFJ13bAdrR8MH38LAdXSaPYUnXgCGHXf-j8dEy-p94HjAOqdrHIilClrvp8sf

Targets

    • Target

      build.exe

    • Size

      1.6MB

    • MD5

      74a170d28a087906ca88927e4a3085dd

    • SHA1

      552b487b32c9c0e5fbb4059c489319d765a63fd0

    • SHA256

      9b51049778d3a3805983eeee1fe35d3945d8298857de0ae57e1885ee63e594da

    • SHA512

      381e260dce7cef7adb2d6caeeea46866ac78c547278e8b7518fcc3df6c2bdd0c6b51fa7d4b4d6ee0715b247e3df5180c22c5bb17c46f21d2366b65319bcced91

    • SSDEEP

      49152:tcTq24GjdGSiqkqXfd+/9AqYanieKdYF:t9EjdGSiqkqXf0FLYW

    Score
    10/10
    stealeriumcollectionspywarestealer

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks